diff --git a/.github/workflows/zephyr.yml b/.github/workflows/zephyr.yml index 571106494ab..770b811309a 100644 --- a/.github/workflows/zephyr.yml +++ b/.github/workflows/zephyr.yml @@ -95,10 +95,18 @@ jobs: # Scope -T to the sample directory (not the whole module) so twister does # not load zephyr/tests/*/testcase.yaml. The condvar test's modern # list-form platform_allow is rejected by the 2.7.4 twister schema, and - # this is the only sample step that runs on 2.7.4. Runs both scenarios - # (wolfssl_test and wolfssl_test_no_malloc). + # this is the only sample step that runs on 2.7.4. + # + # Name the two scenarios rather than running the whole sample: the rest + # need a Zephyr these versions predate - hierarchical board names, + # COMMON_LIBC_MALLOC_ARENA_SIZE, and toolchains beyond the x86_64 one + # installed above. --test drops the others before their platform_allow + # is resolved, so an unrecognized board does not abort the run - but + # the yaml is still parsed, so a modern-only key would. run: | - ./zephyr/scripts/twister -T modules/crypto/wolfssl/zephyr/samples/wolfssl_test -vvv + ./zephyr/scripts/twister -T modules/crypto/wolfssl/zephyr/samples/wolfssl_test \ + --test sample.crypto.wolfssl_test \ + --test sample.crypto.wolfssl_test_no_malloc -vvv rm -rf zephyr/twister-out - name: Run wolfssl TLS sock test diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras index 6ab44d93c9c..fc8eeaf971b 100644 --- a/.wolfssl_known_macro_extras +++ b/.wolfssl_known_macro_extras @@ -70,12 +70,17 @@ CONFIG_ARCH_POSIX CONFIG_ARCH_TEGRA CONFIG_ARM CONFIG_ARM64 +CONFIG_ARMV6_M_ARMV8_M_BASELINE +CONFIG_ARMV7_M_ARMV8_M_MAINLINE CONFIG_BOARD_NATIVE_POSIX CONFIG_BOARD_NATIVE_SIM CONFIG_COMPILER_OPTIMIZATION_DEFAULT CONFIG_COMPILER_OPTIMIZATION_NONE CONFIG_COMPILER_OPTIMIZATION_PERF CONFIG_COMPILER_OPTIMIZATION_SIZE +CONFIG_CPU_AARCH32_CORTEX_A +CONFIG_CPU_AARCH32_CORTEX_R +CONFIG_CPU_CORTEX_M CONFIG_CRYPTO_AES CONFIG_CRYPTO_CBC CONFIG_CRYPTO_CCM @@ -171,14 +176,14 @@ CONFIG_TIMER_TASK_STACK_SIZE CONFIG_TLS_STACK_WOLFSSL CONFIG_USE_WOLFSSL_ESP_SDK_TIME CONFIG_USE_WOLFSSL_ESP_SDK_WIFI -CONFIG_WOLFCRYPT_ARMASM +CONFIG_WOLFCRYPT_ASM CONFIG_WOLFCRYPT_FIPS CONFIG_WOLFCRYPT_FIPS_READY CONFIG_WOLFCRYPT_FIPS_V2 CONFIG_WOLFCRYPT_FIPS_V5 CONFIG_WOLFCRYPT_FIPS_V6 CONFIG_WOLFCRYPT_FIPS_V7 -CONFIG_WOLFCRYPT_INTELASM +CONFIG_WOLFCRYPT_SP_SMALL CONFIG_WOLFSSL CONFIG_WOLFSSL_ALLOW_TLS13 CONFIG_WOLFSSL_ALPN @@ -193,6 +198,11 @@ CONFIG_WOLFSSL_CRYPTO_ONLY CONFIG_WOLFSSL_CURVE25519 CONFIG_WOLFSSL_DTLS CONFIG_WOLFSSL_ECC +CONFIG_WOLFSSL_ECC_256 +CONFIG_WOLFSSL_ECC_384 +CONFIG_WOLFSSL_ECC_512 +CONFIG_WOLFSSL_ECC_521 +CONFIG_WOLFSSL_ECC_BRAINPOOL CONFIG_WOLFSSL_ENABLE_KYBER CONFIG_WOLFSSL_EXAMPLE_NAME_ESP32_SSH_SERVER CONFIG_WOLFSSL_EXAMPLE_NAME_ESP8266_SSH_SERVER @@ -224,7 +234,6 @@ CONFIG_WOLFSSL_SINGLE_THREADED CONFIG_WOLFSSL_SNI CONFIG_WOLFSSL_TARGET_HOST CONFIG_WOLFSSL_TARGET_PORT -CONFIG_WOLFSSL_TLS13_ENABLED CONFIG_WOLFSSL_TLS_VERSION_1_2 CONFIG_WOLFSSL_TLS_VERSION_1_3 CONFIG_WOLFSSL_XMSS @@ -1087,6 +1096,7 @@ WOLFSSL_SNIFFER_NO_RECOVERY WOLFSSL_SP_ARM32_UDIV WOLFSSL_SP_FAST_NCT_EXPTMOD WOLFSSL_SP_INT_SQR_VOLATILE +WOLFSSL_SP_USE_UDIV WOLFSSL_SSLKEYLOGFILE_USE_ENV WOLFSSL_STACK_CHECK WOLFSSL_STM32C5 @@ -1235,6 +1245,7 @@ __ARM_ARCH_7M__ __ARM_ARCH_PROFILE __ARM_FEATURE_CRYPTO __ARM_FEATURE_DSP +__ARM_FEATURE_QRDMX __ARM_FEATURE_SIMD32 __ARM_FEATURE_SME __ARM_FEATURE_SVE diff --git a/wolfcrypt/src/cpuid.c b/wolfcrypt/src/cpuid.c index fd8ec2d0088..d7ece10d894 100644 --- a/wolfcrypt/src/cpuid.c +++ b/wolfcrypt/src/cpuid.c @@ -85,6 +85,20 @@ #define cpuid(a,b,c) __cpuidex((int*)a,b,c) #endif /* _MSC_VER */ + /* Read XCR0. Only valid once CPUID.1:ECX.OSXSAVE[27] is known set. */ + #ifndef _MSC_VER + static WC_INLINE word32 cpuid_xgetbv0(void) + { + word32 eax, edx; + __asm__ __volatile__ ("xgetbv" + : "=a" (eax), "=d" (edx) : "c" (0)); + (void)edx; + return eax; + } + #else + #define cpuid_xgetbv0() ((word32)_xgetbv(0)) + #endif /* _MSC_VER */ + #define EAX 0 #define EBX 1 #define ECX 2 @@ -116,6 +130,31 @@ XMEMCMP((char *)&(reg[ECX]), "cAMD", 4) == 0); } + /* XCR0 state-component masks. AVX needs the SSE and AVX regions; AVX-512 + * also needs opmask, ZMM_Hi256 and Hi16_ZMM on top of them. */ + #define WC_XCR0_AVX 0x06 + #define WC_XCR0_AVX512 0xe6 + + /* Return 1 when the OS has enabled XSAVE and every state component in + * 'mask'. CPUID's feature bits only say the silicon has the unit; + * executing the instruction also needs CR4.OSXSAVE and the matching XCR0 + * bits, which an OS that does not context-switch those registers leaves + * clear. Without this test wolfSSL dispatches the vector code on such a + * system and it faults with #UD. */ + static int cpuid_os_state_enabled(word32 mask) + { + unsigned int reg[5]; + + XMEMSET(reg, '\0', sizeof(reg)); + cpuid(reg, 1, 0); + + /* CPUID.1:ECX.OSXSAVE[27] - XGETBV is illegal when this is clear. */ + if (((reg[ECX] >> 27) & 0x1) == 0) + return 0; + + return (cpuid_xgetbv0() & mask) == mask; + } + static cpuid_flags_t cpuid_flag(word32 leaf, word32 sub, word32 num, word32 bit) { @@ -139,8 +178,13 @@ #endif cpuid_flags_t new_cpuid_flags = 0, old_cpuid_flags = WC_CPUID_INITIALIZER; - if (cpuid_flag(1, 0, ECX, 28)) { new_cpuid_flags |= CPUID_AVX1 ; } - if (cpuid_flag(7, 0, EBX, 5)) { new_cpuid_flags |= CPUID_AVX2 ; } + int os_avx = cpuid_os_state_enabled(WC_XCR0_AVX); + int os_avx512 = cpuid_os_state_enabled(WC_XCR0_AVX512); + + if (os_avx) { + if (cpuid_flag(1, 0, ECX, 28)) { new_cpuid_flags |= CPUID_AVX1; } + if (cpuid_flag(7, 0, EBX, 5)) { new_cpuid_flags |= CPUID_AVX2; } + } if (cpuid_flag(7, 0, EBX, 8)) { new_cpuid_flags |= CPUID_BMI2 ; } if (cpuid_flag(1, 0, ECX, 30)) { new_cpuid_flags |= CPUID_RDRAND; } if (cpuid_flag(7, 0, EBX, 18)) { new_cpuid_flags |= CPUID_RDSEED; } @@ -149,25 +193,30 @@ if (cpuid_flag(1, 0, ECX, 22)) { new_cpuid_flags |= CPUID_MOVBE ; } if (cpuid_flag(7, 0, EBX, 3)) { new_cpuid_flags |= CPUID_BMI1 ; } if (cpuid_flag(7, 0, EBX, 29)) { new_cpuid_flags |= CPUID_SHA ; } - if (cpuid_flag(7, 0, ECX, 9)) { new_cpuid_flags |= CPUID_VAES ; } - if (cpuid_flag(7, 0, EBX, 16)) { new_cpuid_flags |= CPUID_AVX512; } - if (cpuid_flag(7, 0, ECX, 1)) { - new_cpuid_flags |= CPUID_AVX512_VBMI; - } - if (cpuid_flag(7, 0, ECX, 6)) { - new_cpuid_flags |= CPUID_AVX512_VBMI2; - } - if (cpuid_flag(7, 0, EBX, 21)) { - new_cpuid_flags |= CPUID_AVX512_IFMA; - } - if (cpuid_flag(7, 0, EBX, 31)) { - new_cpuid_flags |= CPUID_AVX512_VL; - } - if (cpuid_flag(7, 0, EBX, 17)) { - new_cpuid_flags |= CPUID_AVX512_DQ; + /* VAES is VEX/EVEX encoded, so it needs the AVX state too. */ + if (os_avx && cpuid_flag(7, 0, ECX, 9)) { + new_cpuid_flags |= CPUID_VAES; } - if (cpuid_flag(7, 0, EBX, 30)) { - new_cpuid_flags |= CPUID_AVX512_BW; + if (os_avx512) { + if (cpuid_flag(7, 0, EBX, 16)) { new_cpuid_flags |= CPUID_AVX512; } + if (cpuid_flag(7, 0, ECX, 1)) { + new_cpuid_flags |= CPUID_AVX512_VBMI; + } + if (cpuid_flag(7, 0, ECX, 6)) { + new_cpuid_flags |= CPUID_AVX512_VBMI2; + } + if (cpuid_flag(7, 0, EBX, 21)) { + new_cpuid_flags |= CPUID_AVX512_IFMA; + } + if (cpuid_flag(7, 0, EBX, 31)) { + new_cpuid_flags |= CPUID_AVX512_VL; + } + if (cpuid_flag(7, 0, EBX, 17)) { + new_cpuid_flags |= CPUID_AVX512_DQ; + } + if (cpuid_flag(7, 0, EBX, 30)) { + new_cpuid_flags |= CPUID_AVX512_BW; + } } if (cpuid_is_intel()) { new_cpuid_flags |= CPUID_INTEL ; } if (cpuid_is_amd()) { new_cpuid_flags |= CPUID_AMD ; } diff --git a/wolfcrypt/src/ecc.c b/wolfcrypt/src/ecc.c index 37b64a89efe..3a29d261e9e 100644 --- a/wolfcrypt/src/ecc.c +++ b/wolfcrypt/src/ecc.c @@ -349,33 +349,24 @@ ECC Curve Sizes: #define HAVE_ECC_CHECK_PUBKEY_ORDER #endif -#if defined(WOLFSSL_SP_MATH_ALL) && SP_INT_BITS < MAX_ECC_BITS_NEEDED +/* MAX_ECC_BITS is the largest curve compiled in unless the user raised it, and + * ecc.h rejects a smaller one. MAX_ECC_BITS_EXTRA is the bit ECC_KEY_MAX_BITS + * adds below, so the working values need room for it too. */ +#if defined(WOLFSSL_SP_MATH_ALL) && \ + SP_INT_BITS < (MAX_ECC_BITS + MAX_ECC_BITS_EXTRA) #define MAX_ECC_BITS_USE SP_INT_BITS #else -#define MAX_ECC_BITS_USE MAX_ECC_BITS_NEEDED +#define MAX_ECC_BITS_USE (MAX_ECC_BITS + MAX_ECC_BITS_EXTRA) #endif -#if !defined(WOLFSSL_CUSTOM_CURVES) && (ECC_MIN_KEY_SZ > 160) && \ - (!defined(HAVE_ECC_KOBLITZ) || (ECC_MIN_KEY_SZ > 224)) - +/* MAX_ECC_BITS_EXTRA (ecc.h) is the one bit the builds whose order can be a bit + * greater than the prime need, and the ceiling is sized from the same macro. */ #define ECC_KEY_MAX_BITS(key) \ ((((key) == NULL) || ((key)->dp == NULL)) ? MAX_ECC_BITS_USE : \ - ((unsigned)((key)->dp->size * 8))) + ((unsigned)((key)->dp->size * 8 + MAX_ECC_BITS_EXTRA))) #define ECC_KEY_MAX_BITS_NONULLCHECK(key) \ (((key)->dp == NULL) ? MAX_ECC_BITS_USE : \ - ((unsigned)((key)->dp->size * 8))) - -#else - -/* Add one bit for cases when order is a bit greater than prime. */ -#define ECC_KEY_MAX_BITS(key) \ - ((((key) == NULL) || ((key)->dp == NULL)) ? MAX_ECC_BITS_USE : \ - ((unsigned)((key)->dp->size * 8 + 1))) -#define ECC_KEY_MAX_BITS_NONULLCHECK(key) \ - (((key)->dp == NULL) ? MAX_ECC_BITS_USE : \ - ((unsigned)((key)->dp->size * 8 + 1))) - -#endif + ((unsigned)((key)->dp->size * 8 + MAX_ECC_BITS_EXTRA))) #ifdef WOLFSSL_ECC_BLIND_K /* Number of digits covered by the fixed-width XORs below. */ @@ -7964,10 +7955,10 @@ int wc_ecc_gen_deterministic_k(const byte* hash, word32 hashSz, { int ret = 0; #ifndef WOLFSSL_SMALL_STACK - byte h1[MAX_ECC_BYTES]; + byte h1[MAX_ECC_ORDER_BYTES]; byte V[WC_MAX_DIGEST_SIZE]; byte K[WC_MAX_DIGEST_SIZE]; - byte x[MAX_ECC_BYTES]; + byte x[MAX_ECC_ORDER_BYTES]; mp_int z1[1]; #else byte *h1 = NULL; @@ -8005,13 +7996,19 @@ int wc_ecc_gen_deterministic_k(const byte* hash, word32 hashSz, } } - if (mp_unsigned_bin_size(priv) > MAX_ECC_BYTES) { + if (mp_unsigned_bin_size(priv) > MAX_ECC_ORDER_BYTES) { WOLFSSL_MSG("private key larger than max expected!"); return BAD_FUNC_ARG; } + /* x and h1 below are written to the order's length. */ + if (mp_unsigned_bin_size(order) > MAX_ECC_ORDER_BYTES) { + WOLFSSL_MSG("order larger than max expected!"); + return BAD_FUNC_ARG; + } + #ifdef WOLFSSL_SMALL_STACK - h1 = (byte*)XMALLOC(MAX_ECC_BYTES, heap, DYNAMIC_TYPE_DIGEST); + h1 = (byte*)XMALLOC(MAX_ECC_ORDER_BYTES, heap, DYNAMIC_TYPE_DIGEST); if (h1 == NULL) { ret = MEMORY_E; } @@ -8029,7 +8026,8 @@ int wc_ecc_gen_deterministic_k(const byte* hash, word32 hashSz, } if (ret == 0) { - x = (byte*)XMALLOC(MAX_ECC_BYTES, heap, DYNAMIC_TYPE_PRIVATE_KEY); + x = (byte*)XMALLOC(MAX_ECC_ORDER_BYTES, heap, + DYNAMIC_TYPE_PRIVATE_KEY); if (x == NULL) ret = MEMORY_E; } @@ -8090,7 +8088,7 @@ int wc_ecc_gen_deterministic_k(const byte* hash, word32 hashSz, /* bits2octets on h1 */ if (ret == 0) { - XMEMSET(h1, 0, MAX_ECC_BYTES); + XMEMSET(h1, 0, MAX_ECC_ORDER_BYTES); #if !defined(WOLFSSL_ECDSA_DETERMINISTIC_K_VARIANT) /* mod reduce by order using conditional subtract @@ -8102,7 +8100,7 @@ int wc_ecc_gen_deterministic_k(const byte* hash, word32 hashSz, mp_sub(z1, order, z1); z1Sz = mp_unsigned_bin_size(z1); - if (z1Sz < 0 || z1Sz > MAX_ECC_BYTES) { + if (z1Sz < 0 || z1Sz > MAX_ECC_ORDER_BYTES) { ret = BUFFER_E; } else { @@ -8205,7 +8203,7 @@ int wc_ecc_gen_deterministic_k(const byte* hash, word32 hashSz, } while (ret == 0 && err != 0); } - ForceZero(x, MAX_ECC_BYTES); + ForceZero(x, MAX_ECC_ORDER_BYTES); ForceZero(K, WC_MAX_DIGEST_SIZE); ForceZero(V, WC_MAX_DIGEST_SIZE); #ifdef WOLFSSL_SMALL_STACK @@ -8215,7 +8213,7 @@ int wc_ecc_gen_deterministic_k(const byte* hash, word32 hashSz, XFREE(V, heap, DYNAMIC_TYPE_ECC_BUFFER); XFREE(h1, heap, DYNAMIC_TYPE_DIGEST); #elif defined(WOLFSSL_CHECK_MEM_ZERO) - wc_MemZero_Check(x, MAX_ECC_BYTES); + wc_MemZero_Check(x, MAX_ECC_ORDER_BYTES); wc_MemZero_Check(K, WC_MAX_DIGEST_SIZE); wc_MemZero_Check(V, WC_MAX_DIGEST_SIZE); #endif diff --git a/wolfcrypt/src/port/arm/armv8-aes-asm.S b/wolfcrypt/src/port/arm/armv8-aes-asm.S index 6895ef04e8f..7de05295d18 100644 --- a/wolfcrypt/src/port/arm/armv8-aes-asm.S +++ b/wolfcrypt/src/port/arm/armv8-aes-asm.S @@ -35,6 +35,7 @@ #ifndef WOLFSSL_ARMASM_INLINE #if !defined(NO_AES) && defined(WOLFSSL_ARMASM) #ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO +.arch_extension crypto #ifndef __APPLE__ .text .globl AES_set_key_AARCH64 @@ -14910,6 +14911,7 @@ L_aes_gcm_decrypt_arm64_crypto_done: #endif /* __APPLE__ */ #endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */ #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3 +.arch_extension sha3 #ifndef __APPLE__ .text .globl AES_GCM_encrypt_AARCH64_EOR3 @@ -32806,6 +32808,7 @@ L_aes_gcm_decrypt_final_arm64_crypto_tag_loaded: #endif /* __APPLE__ */ #endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */ #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3 +.arch_extension sha3 #ifndef __APPLE__ .text .globl AES_GCM_init_AARCH64_EOR3 diff --git a/wolfcrypt/src/port/arm/armv8-aes-asm.asm b/wolfcrypt/src/port/arm/armv8-aes-asm.asm index 80ddad8cde1..29fd7aee5ca 100644 --- a/wolfcrypt/src/port/arm/armv8-aes-asm.asm +++ b/wolfcrypt/src/port/arm/armv8-aes-asm.asm @@ -25,6 +25,7 @@ ; ../wolfssl/wolfcrypt/src/port/arm/armv8-aes-asm.asm IF :LNOT::DEF:NO_AES :LAND: {TRUE} IF :LNOT::DEF:WOLFSSL_ARMASM_NO_HW_CRYPTO +; .arch_extension crypto AREA |.text|, CODE, READONLY ALIGN 4 EXPORT AES_set_key_AARCH64 @@ -14768,6 +14769,7 @@ L_aes_gcm_decrypt_arm64_crypto_done ENDP ENDIF IF :DEF:WOLFSSL_ARMASM_CRYPTO_SHA3 +; .arch_extension sha3 AREA |.text|, CODE, READONLY ALIGN 4 EXPORT AES_GCM_encrypt_AARCH64_EOR3 @@ -32544,6 +32546,7 @@ L_aes_gcm_decrypt_final_arm64_crypto_tag_loaded ENDP ENDIF IF :DEF:WOLFSSL_ARMASM_CRYPTO_SHA3 +; .arch_extension sha3 AREA |.text|, CODE, READONLY ALIGN 4 EXPORT AES_GCM_init_AARCH64_EOR3 diff --git a/wolfcrypt/src/port/arm/armv8-aes-asm_c.c b/wolfcrypt/src/port/arm/armv8-aes-asm_c.c index a39acf46bae..a5efad2975d 100644 --- a/wolfcrypt/src/port/arm/armv8-aes-asm_c.c +++ b/wolfcrypt/src/port/arm/armv8-aes-asm_c.c @@ -41,6 +41,7 @@ void AES_set_key_AARCH64(const byte* userKey, int keylen, byte* key, int dir) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "cmp %x[keylen], #24\n\t" "b.lt L_aes_set_key_arm64_crypto_start_128_%=\n\t" "b.gt L_aes_set_key_arm64_crypto_start_256_%=\n\t" @@ -591,6 +592,7 @@ void AES_set_key_AARCH64(const byte* userKey, int keylen, byte* key, int dir) void AES_encrypt_AARCH64(const byte* inBlock, byte* outBlock, byte* key, int nr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v0.16b}, [%x[inBlock]]\n\t" "ld1 {v1.2d, v2.2d, v3.2d, v4.2d}, [%x[key]], #0x40\n\t" "aese v0.16b, v1.16b\n\t" @@ -648,6 +650,7 @@ void AES_encrypt_AARCH64(const byte* inBlock, byte* outBlock, byte* key, int nr) void AES_decrypt_AARCH64(const byte* inBlock, byte* outBlock, byte* key, int nr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v0.16b}, [%x[inBlock]]\n\t" "ld1 {v1.2d, v2.2d, v3.2d, v4.2d}, [%x[key]], #0x40\n\t" "aesd v0.16b, v1.16b\n\t" @@ -704,6 +707,7 @@ void AES_encrypt_blocks_AARCH64(const byte* in, byte* out, word32 sz, byte* key, int nr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v16.2d, v17.2d, v18.2d, v19.2d}, [%x[key]], #0x40\n\t" "ld1 {v20.2d, v21.2d, v22.2d, v23.2d}, [%x[key]], #0x40\n\t" "ld1 {v24.2d, v25.2d, v26.2d}, [%x[key]], #48\n\t" @@ -1925,6 +1929,7 @@ void AES_decrypt_blocks_AARCH64(const byte* in, byte* out, word32 sz, byte* key, int nr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v16.2d, v17.2d, v18.2d, v19.2d}, [%x[key]], #0x40\n\t" "ld1 {v20.2d, v21.2d, v22.2d, v23.2d}, [%x[key]], #0x40\n\t" "ld1 {v24.2d, v25.2d, v26.2d}, [%x[key]], #48\n\t" @@ -3148,6 +3153,7 @@ void AES_CBC_encrypt_AARCH64(const byte* in, byte* out, word32 sz, byte* reg, byte* key, int nr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v16.2d, v17.2d, v18.2d, v19.2d}, [%x[key]], #0x40\n\t" "ld1 {v20.2d, v21.2d, v22.2d, v23.2d}, [%x[key]], #0x40\n\t" "ld1 {v0.2d}, [%x[reg]]\n\t" @@ -3286,6 +3292,7 @@ void AES_CBC_decrypt_AARCH64(const byte* in, byte* out, word32 sz, byte* reg, byte* key, int nr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v16.2d, v17.2d, v18.2d, v19.2d}, [%x[key]], #0x40\n\t" "ld1 {v20.2d, v21.2d, v22.2d, v23.2d}, [%x[key]], #0x40\n\t" "ld1 {v0.2d}, [%x[reg]]\n\t" @@ -3544,6 +3551,7 @@ void AES_CTR_encrypt_AARCH64(const byte* in, byte* out, word32 sz, byte* reg, byte* key, byte* tmp, word32* left, word32 nr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v0.2d, v1.2d, v2.2d, v3.2d}, [%x[key]], #0x40\n\t" "ld1 {v4.2d, v5.2d, v6.2d, v7.2d}, [%x[key]], #0x40\n\t" "ld1 {v15.2d}, [%x[reg]]\n\t" @@ -5211,6 +5219,7 @@ void AES_GCM_set_key_AARCH64(const byte* nonce, const byte* key, byte* gcm_h, int nr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v0.16b}, [%x[nonce]]\n\t" "ld1 {v1.2d, v2.2d, v3.2d, v4.2d}, [%x[key]], #0x40\n\t" "aese v0.16b, v1.16b\n\t" @@ -5265,6 +5274,7 @@ void AES_GCM_encrypt_AARCH64(const byte* in, byte* out, word32 sz, word32 aadSz, byte* key, byte* gcm_h, byte* tmp, byte* reg, int nr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "movi v27.16b, #0x87\n\t" "eor v26.16b, v26.16b, v26.16b\n\t" "ushr v27.2d, v27.2d, #56\n\t" @@ -10140,6 +10150,7 @@ int AES_GCM_decrypt_AARCH64(const byte* in, byte* out, word32 sz, int nr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "movi v27.16b, #0x87\n\t" "eor v26.16b, v26.16b, v26.16b\n\t" "ushr v27.2d, v27.2d, #56\n\t" @@ -15068,6 +15079,8 @@ void AES_GCM_encrypt_AARCH64_EOR3(const byte* in, byte* out, word32 sz, word32 aadSz, byte* key, byte* gcm_h, byte* tmp, byte* reg, int nr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" + ".arch_extension sha3\n\t" "movi v27.16b, #0x87\n\t" "eor v26.16b, v26.16b, v26.16b\n\t" "ushr v27.2d, v27.2d, #56\n\t" @@ -19837,6 +19850,8 @@ int AES_GCM_decrypt_AARCH64_EOR3(const byte* in, byte* out, word32 sz, int nr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" + ".arch_extension sha3\n\t" "movi v27.16b, #0x87\n\t" "eor v26.16b, v26.16b, v26.16b\n\t" "ushr v27.2d, v27.2d, #56\n\t" @@ -24656,6 +24671,7 @@ void AES_GCM_init_AARCH64(byte* key, int nr, const byte* nonce, word32 nonceSz, byte* gcm_h, byte* counter, byte* initCtr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "movi v6.16b, #0x87\n\t" "ld1 {v5.2d}, [%x[gcm_h]]\n\t" "ushr v6.2d, v6.2d, #56\n\t" @@ -24833,6 +24849,7 @@ void AES_GCM_init_AARCH64(byte* key, int nr, const byte* nonce, word32 nonceSz, void AES_GCM_ghash_block_AARCH64(const byte* data, byte* tag, byte* gcm_h) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v6.2d}, [%x[tag]]\n\t" "movi v7.16b, #0x87\n\t" "ld1 {v5.2d}, [%x[gcm_h]]\n\t" @@ -24867,6 +24884,7 @@ void AES_GCM_aad_update_AARCH64(const byte* aadt, word32 abytes, byte* tag, byte* gcm_h) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v20.2d}, [%x[tag]]\n\t" "movi v21.16b, #0x87\n\t" "ld1 {v12.2d}, [%x[gcm_h]]\n\t" @@ -25213,6 +25231,7 @@ void AES_GCM_encrypt_block_AARCH64(const byte* key, int nr, byte* out, const byte* in, byte* counter) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v5.2d}, [%x[counter]]\n\t" "ld1 {v4.2d}, [%x[in]]\n\t" "mov w5, v5.s[3]\n\t" @@ -25273,6 +25292,7 @@ void AES_GCM_encrypt_update_AARCH64(const byte* key, int nr, byte* out, const byte* in, word32 nbytes, byte* tag, byte* h, byte* counter) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v13.2d}, [%x[counter]]\n\t" "movi v27.16b, #0x87\n\t" "ld1 {v26.2d}, [%x[tag]]\n\t" @@ -29100,6 +29120,7 @@ void AES_GCM_encrypt_final_AARCH64(byte* tag, byte* authTag, word32 tbytes, word32 nbytes, word32 abytes, byte* h, byte* initCtr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v5.2d}, [%x[tag]]\n\t" "movi v6.16b, #0x87\n\t" "ld1 {v4.2d}, [%x[h]]\n\t" @@ -29180,6 +29201,7 @@ void AES_GCM_decrypt_update_AARCH64(const byte* key, int nr, byte* out, const byte* in, word32 nbytes, byte* tag, byte* h, byte* counter) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v13.2d}, [%x[counter]]\n\t" "movi v27.16b, #0x87\n\t" "ld1 {v26.2d}, [%x[tag]]\n\t" @@ -33009,6 +33031,7 @@ void AES_GCM_decrypt_final_AARCH64(byte* tag, const byte* authTag, int* res) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v5.2d}, [%x[tag]]\n\t" "movi v6.16b, #0x87\n\t" "ld1 {v4.2d}, [%x[h]]\n\t" @@ -33115,6 +33138,8 @@ void AES_GCM_init_AARCH64_EOR3(byte* key, int nr, const byte* nonce, word32 nonceSz, byte* gcm_h, byte* counter, byte* initCtr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" + ".arch_extension sha3\n\t" "movi v6.16b, #0x87\n\t" "ld1 {v5.2d}, [%x[gcm_h]]\n\t" "ushr v6.2d, v6.2d, #56\n\t" @@ -33289,6 +33314,8 @@ void AES_GCM_init_AARCH64_EOR3(byte* key, int nr, const byte* nonce, void AES_GCM_ghash_block_AARCH64_EOR3(const byte* data, byte* tag, byte* gcm_h) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" + ".arch_extension sha3\n\t" "ld1 {v6.2d}, [%x[tag]]\n\t" "movi v7.16b, #0x87\n\t" "ld1 {v5.2d}, [%x[gcm_h]]\n\t" @@ -33322,6 +33349,8 @@ void AES_GCM_aad_update_AARCH64_EOR3(const byte* aadt, word32 abytes, byte* tag, byte* gcm_h) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" + ".arch_extension sha3\n\t" "ld1 {v20.2d}, [%x[tag]]\n\t" "movi v21.16b, #0x87\n\t" "ld1 {v12.2d}, [%x[gcm_h]]\n\t" @@ -33650,6 +33679,8 @@ void AES_GCM_encrypt_block_AARCH64_EOR3(const byte* key, int nr, byte* out, const byte* in, byte* counter) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" + ".arch_extension sha3\n\t" "ld1 {v5.2d}, [%x[counter]]\n\t" "ld1 {v4.2d}, [%x[in]]\n\t" "mov w5, v5.s[3]\n\t" @@ -33710,6 +33741,8 @@ void AES_GCM_encrypt_update_AARCH64_EOR3(const byte* key, int nr, byte* out, const byte* in, word32 nbytes, byte* tag, byte* h, byte* counter) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" + ".arch_extension sha3\n\t" "ld1 {v13.2d}, [%x[counter]]\n\t" "movi v27.16b, #0x87\n\t" "ld1 {v26.2d}, [%x[tag]]\n\t" @@ -37453,6 +37486,8 @@ void AES_GCM_encrypt_final_AARCH64_EOR3(byte* tag, byte* authTag, word32 tbytes, word32 nbytes, word32 abytes, byte* h, byte* initCtr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" + ".arch_extension sha3\n\t" "ld1 {v5.2d}, [%x[tag]]\n\t" "movi v6.16b, #0x87\n\t" "ld1 {v4.2d}, [%x[h]]\n\t" @@ -37532,6 +37567,8 @@ void AES_GCM_decrypt_update_AARCH64_EOR3(const byte* key, int nr, byte* out, const byte* in, word32 nbytes, byte* tag, byte* h, byte* counter) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" + ".arch_extension sha3\n\t" "ld1 {v13.2d}, [%x[counter]]\n\t" "movi v27.16b, #0x87\n\t" "ld1 {v26.2d}, [%x[tag]]\n\t" @@ -41277,6 +41314,8 @@ void AES_GCM_decrypt_final_AARCH64_EOR3(byte* tag, const byte* authTag, int* res) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" + ".arch_extension sha3\n\t" "ld1 {v5.2d}, [%x[tag]]\n\t" "movi v6.16b, #0x87\n\t" "ld1 {v4.2d}, [%x[h]]\n\t" @@ -41386,6 +41425,7 @@ void AES_XTS_encrypt_AARCH64(const byte* in, byte* out, word32 sz, const byte* i, byte* key, byte* key2, byte* tmp, int nr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v16.2d, v17.2d, v18.2d, v19.2d}, [%x[key2]], #0x40\n\t" "ld1 {v20.2d, v21.2d, v22.2d, v23.2d}, [%x[key2]], #0x40\n\t" "ld1 {v4.16b}, [%x[i]]\n\t" @@ -42410,6 +42450,7 @@ void AES_XTS_decrypt_AARCH64(const byte* in, byte* out, word32 sz, const byte* i, byte* key, byte* key2, byte* tmp, int nr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v16.2d, v17.2d, v18.2d, v19.2d}, [%x[key2]], #0x40\n\t" "ld1 {v20.2d, v21.2d, v22.2d, v23.2d}, [%x[key2]], #0x40\n\t" "ld1 {v4.16b}, [%x[i]]\n\t" @@ -43531,6 +43572,7 @@ void AES_GCMSIV_polyval_pmull(unsigned char* s, const unsigned char* h, const unsigned char* data, unsigned int blocks) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "movi v2.16b, #0\n\t" "ld1 {v1.16b}, [%x[h]]\n\t" "ld1 {v0.16b}, [%x[s]]\n\t" @@ -44061,6 +44103,7 @@ void AES_GCMSIV_ctr_aarch64(const unsigned char* in, unsigned char* out, unsigned long length, const unsigned char* KS, int nr, unsigned char* ctr) { __asm__ __volatile__ ( + ".arch_extension crypto\n\t" "ld1 {v15.2d}, [%x[ctr]]\n\t" "mov w7, v15.s[0]\n\t" "lsr x6, %x[length], #4\n\t" diff --git a/wolfcrypt/src/port/arm/armv8-frodokem-asm.S b/wolfcrypt/src/port/arm/armv8-frodokem-asm.S index 1e5188193fe..aba36e6d8bd 100644 --- a/wolfcrypt/src/port/arm/armv8-frodokem-asm.S +++ b/wolfcrypt/src/port/arm/armv8-frodokem-asm.S @@ -326,9 +326,7 @@ _frodokem_sha3_x2_crypto: adrp x1, L_sha3_aarch64_r@PAGE add x1, x1, L_sha3_aarch64_r@PAGEOFF #endif /* __APPLE__ */ -#ifdef __APPLE__ .arch_extension sha3 -#endif /* __APPLE__ */ ld4 {v0.d, v1.d, v2.d, v3.d}[0], [x0], #32 ld4 {v4.d, v5.d, v6.d, v7.d}[0], [x0], #32 ld4 {v8.d, v9.d, v10.d, v11.d}[0], [x0], #32 diff --git a/wolfcrypt/src/port/arm/armv8-frodokem-asm_c.c b/wolfcrypt/src/port/arm/armv8-frodokem-asm_c.c index 40bd4de1271..000f471aecd 100644 --- a/wolfcrypt/src/port/arm/armv8-frodokem-asm_c.c +++ b/wolfcrypt/src/port/arm/armv8-frodokem-asm_c.c @@ -272,9 +272,7 @@ void frodokem_sha3_x2_crypto(word64* state) { const word64* r = L_sha3_aarch64_r; __asm__ __volatile__ ( -#ifdef __APPLE__ ".arch_extension sha3\n\t" -#endif /* __APPLE__ */ "ld4 {v0.d, v1.d, v2.d, v3.d}[0], [%x[state]], #32\n\t" "ld4 {v4.d, v5.d, v6.d, v7.d}[0], [%x[state]], #32\n\t" "ld4 {v8.d, v9.d, v10.d, v11.d}[0], [%x[state]], #32\n\t" diff --git a/wolfcrypt/src/port/arm/armv8-mlkem-asm.S b/wolfcrypt/src/port/arm/armv8-mlkem-asm.S index 14010de9035..c10af417373 100644 --- a/wolfcrypt/src/port/arm/armv8-mlkem-asm.S +++ b/wolfcrypt/src/port/arm/armv8-mlkem-asm.S @@ -33,6 +33,7 @@ #ifdef WOLFSSL_ARMASM #ifdef __aarch64__ #ifndef WOLFSSL_ARMASM_INLINE +#ifdef WOLFSSL_HAVE_MLKEM #ifndef __APPLE__ .text .section .rodata @@ -49,7 +50,6 @@ #endif /* __APPLE__ */ L_mlkem_aarch64_consts: .short 0x0d01,0xf301,0x4ebf,0x0549,0x5049,0x0000,0x0000,0x0000 -#ifdef WOLFSSL_HAVE_MLKEM #ifndef __APPLE__ .text .section .rodata @@ -9765,6 +9765,7 @@ L_sha3_aarch64_r: .quad 0x8000000080008081,0x8000000000008080 .quad 0x0000000080000001,0x8000000080008008 #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3 +.arch_extension sha3 #ifndef __APPLE__ .text .globl mlkem_sha3_blocksx3_crypto diff --git a/wolfcrypt/src/port/arm/armv8-mlkem-asm.asm b/wolfcrypt/src/port/arm/armv8-mlkem-asm.asm index d72216929d1..f9a41ce0415 100644 --- a/wolfcrypt/src/port/arm/armv8-mlkem-asm.asm +++ b/wolfcrypt/src/port/arm/armv8-mlkem-asm.asm @@ -23,11 +23,11 @@ ; cd ../scripts ; ruby ./kyber/kyber.rb arm64 \ ; ../wolfssl/wolfcrypt/src/port/arm/armv8-mlkem-asm.asm + IF :DEF:WOLFSSL_HAVE_MLKEM AREA |.rodata|, DATA, READONLY, ALIGN=4 ALIGN 8 L_mlkem_aarch64_consts DCW 0x0d01, 0xf301, 0x4ebf, 0x0549, 0x5049, 0x0000, 0x0000, 0x0000 - IF :DEF:WOLFSSL_HAVE_MLKEM AREA |.rodata|, DATA, READONLY, ALIGN=4 ALIGN 8 L_mlkem_aarch64_zetas @@ -9216,6 +9216,7 @@ L_sha3_aarch64_r DCQ 0x8000000080008081, 0x8000000000008080 DCQ 0x0000000080000001, 0x8000000080008008 IF :DEF:WOLFSSL_ARMASM_CRYPTO_SHA3 +; .arch_extension sha3 AREA |.text|, CODE, READONLY ALIGN 4 EXPORT mlkem_sha3_blocksx3_crypto diff --git a/wolfcrypt/src/port/arm/armv8-mlkem-asm_c.c b/wolfcrypt/src/port/arm/armv8-mlkem-asm_c.c index 2b1f5b40b0f..8788b1b3ea0 100644 --- a/wolfcrypt/src/port/arm/armv8-mlkem-asm_c.c +++ b/wolfcrypt/src/port/arm/armv8-mlkem-asm_c.c @@ -34,13 +34,13 @@ #ifdef WOLFSSL_ARMASM #ifdef __aarch64__ #ifdef WOLFSSL_ARMASM_INLINE +#include + +#ifdef WOLFSSL_HAVE_MLKEM XALIGNED(4) static const word16 L_mlkem_aarch64_consts[] = { 0x0d01, 0xf301, 0x4ebf, 0x0549, 0x5049, 0x0000, 0x0000, 0x0000, }; -#include - -#ifdef WOLFSSL_HAVE_MLKEM XALIGNED(4) static const word16 L_mlkem_aarch64_zetas[] = { 0x08ed, 0x0a0b, 0x0b9a, 0x0714, 0x05d5, 0x058e, 0x011f, 0x00ca, 0x0c56, 0x026e, 0x0629, 0x00b6, 0x03c2, 0x084f, 0x073f, 0x05bc, @@ -9124,6 +9124,7 @@ void mlkem_sha3_blocksx3_crypto(word64* state) { const word64* r = L_sha3_aarch64_r; __asm__ __volatile__ ( + ".arch_extension sha3\n\t" "stp x29, x30, [sp, #-64]!\n\t" "add x29, sp, #0\n\t" "str %x[state], [x29, #40]\n\t" @@ -9423,6 +9424,7 @@ void mlkem_shake128_blocksx3_seed_crypto(word64* state, byte* seed) { const word64* r = L_sha3_aarch64_r; __asm__ __volatile__ ( + ".arch_extension sha3\n\t" "stp x29, x30, [sp, #-64]!\n\t" "add x29, sp, #0\n\t" "str %x[state], [x29, #40]\n\t" @@ -9744,6 +9746,7 @@ void mlkem_shake256_blocksx3_seed_crypto(word64* state, byte* seed) { const word64* r = L_sha3_aarch64_r; __asm__ __volatile__ ( + ".arch_extension sha3\n\t" "stp x29, x30, [sp, #-64]!\n\t" "add x29, sp, #0\n\t" "str %x[state], [x29, #40]\n\t" diff --git a/wolfcrypt/src/port/arm/armv8-sha256-asm.S b/wolfcrypt/src/port/arm/armv8-sha256-asm.S index f8c26311b57..9a97d5b0950 100644 --- a/wolfcrypt/src/port/arm/armv8-sha256-asm.S +++ b/wolfcrypt/src/port/arm/armv8-sha256-asm.S @@ -1058,6 +1058,7 @@ L_sha256_len_neon_start: .size Transform_Sha256_Len_neon,.-Transform_Sha256_Len_neon #endif /* __APPLE__ */ #ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO +.arch_extension crypto #ifndef __APPLE__ .text .section .rodata diff --git a/wolfcrypt/src/port/arm/armv8-sha256-asm.asm b/wolfcrypt/src/port/arm/armv8-sha256-asm.asm index 454fe592d32..f60d0e90d7d 100644 --- a/wolfcrypt/src/port/arm/armv8-sha256-asm.asm +++ b/wolfcrypt/src/port/arm/armv8-sha256-asm.asm @@ -1019,6 +1019,7 @@ L_sha256_len_neon_start ret ENDP IF :LNOT::DEF:WOLFSSL_ARMASM_NO_HW_CRYPTO +; .arch_extension crypto AREA |.rodata|, DATA, READONLY, ALIGN=4 ALIGN 8 L_SHA256_trans_crypto_len_k diff --git a/wolfcrypt/src/port/arm/armv8-sha256-asm_c.c b/wolfcrypt/src/port/arm/armv8-sha256-asm_c.c index 42b3a2b563e..b6a9e3f948e 100644 --- a/wolfcrypt/src/port/arm/armv8-sha256-asm_c.c +++ b/wolfcrypt/src/port/arm/armv8-sha256-asm_c.c @@ -1050,6 +1050,7 @@ void Transform_Sha256_Len_crypto(wc_Sha256* sha256, const byte* data, { const word32* k = L_SHA256_trans_crypto_len_k; __asm__ __volatile__ ( + ".arch_extension crypto\n\t" /* Load K into vector registers */ "ld1 {v8.4s, v9.4s, v10.4s, v11.4s}, [%[k]], #0x40\n\t" "ld1 {v12.4s, v13.4s, v14.4s, v15.4s}, [%[k]], #0x40\n\t" diff --git a/wolfcrypt/src/port/arm/armv8-sha3-asm.S b/wolfcrypt/src/port/arm/armv8-sha3-asm.S index c9ad4a5f333..021f6a513fa 100644 --- a/wolfcrypt/src/port/arm/armv8-sha3-asm.S +++ b/wolfcrypt/src/port/arm/armv8-sha3-asm.S @@ -89,9 +89,7 @@ _BlockSha3_crypto: adrp x1, L_SHA3_transform_crypto_r@PAGE add x1, x1, L_SHA3_transform_crypto_r@PAGEOFF #endif /* __APPLE__ */ -#ifdef __APPLE__ .arch_extension sha3 -#endif /* __APPLE__ */ ld4 {v0.d, v1.d, v2.d, v3.d}[0], [x0], #32 ld4 {v4.d, v5.d, v6.d, v7.d}[0], [x0], #32 ld4 {v8.d, v9.d, v10.d, v11.d}[0], [x0], #32 diff --git a/wolfcrypt/src/port/arm/armv8-sha3-asm_c.c b/wolfcrypt/src/port/arm/armv8-sha3-asm_c.c index 264be7b156e..0386dfd2445 100644 --- a/wolfcrypt/src/port/arm/armv8-sha3-asm_c.c +++ b/wolfcrypt/src/port/arm/armv8-sha3-asm_c.c @@ -57,9 +57,7 @@ void BlockSha3_crypto(word64* state) { const word64* r = L_SHA3_transform_crypto_r; __asm__ __volatile__ ( -#ifdef __APPLE__ ".arch_extension sha3\n\t" -#endif /* __APPLE__ */ "ld4 {v0.d, v1.d, v2.d, v3.d}[0], [%x[state]], #32\n\t" "ld4 {v4.d, v5.d, v6.d, v7.d}[0], [%x[state]], #32\n\t" "ld4 {v8.d, v9.d, v10.d, v11.d}[0], [%x[state]], #32\n\t" diff --git a/wolfcrypt/src/port/arm/armv8-sha512-asm.S b/wolfcrypt/src/port/arm/armv8-sha512-asm.S index 2e894827c84..298e19b3c0d 100644 --- a/wolfcrypt/src/port/arm/armv8-sha512-asm.S +++ b/wolfcrypt/src/port/arm/armv8-sha512-asm.S @@ -1136,9 +1136,7 @@ _Transform_Sha512_Len_crypto: adrp x4, L_SHA512_trans_crypto_len_k@PAGE add x4, x4, L_SHA512_trans_crypto_len_k@PAGEOFF #endif /* __APPLE__ */ -#ifdef __APPLE__ .arch_extension sha3 -#endif /* __APPLE__ */ # Load K into vector registers ld1 {v8.2d, v9.2d, v10.2d, v11.2d}, [x4], #0x40 ld1 {v12.2d, v13.2d, v14.2d, v15.2d}, [x4], #0x40 diff --git a/wolfcrypt/src/port/arm/armv8-sha512-asm_c.c b/wolfcrypt/src/port/arm/armv8-sha512-asm_c.c index 852e3c3ffdf..c7e9eac1a92 100644 --- a/wolfcrypt/src/port/arm/armv8-sha512-asm_c.c +++ b/wolfcrypt/src/port/arm/armv8-sha512-asm_c.c @@ -1050,9 +1050,7 @@ void Transform_Sha512_Len_crypto(wc_Sha512* sha512, const byte* data, { const word64* k = L_SHA512_trans_crypto_len_k; __asm__ __volatile__ ( -#ifdef __APPLE__ ".arch_extension sha3\n\t" -#endif /* __APPLE__ */ /* Load K into vector registers */ "ld1 {v8.2d, v9.2d, v10.2d, v11.2d}, [%[k]], #0x40\n\t" "ld1 {v12.2d, v13.2d, v14.2d, v15.2d}, [%[k]], #0x40\n\t" diff --git a/wolfcrypt/src/sp_x86_64.c b/wolfcrypt/src/sp_x86_64.c index 220550e4e6c..48c1bd2da83 100644 --- a/wolfcrypt/src/sp_x86_64.c +++ b/wolfcrypt/src/sp_x86_64.c @@ -594,7 +594,7 @@ static WC_INLINE sp_digit div_2048_word_16(sp_digit d1, sp_digit d0, static WC_INLINE sp_digit div_2048_word_16(sp_digit d1, sp_digit d0, sp_digit div) { - register sp_digit r asm("rax"); + register sp_digit r __asm__("rax"); __asm__ __volatile__ ( "divq %3" : "=a" (r) @@ -1277,7 +1277,7 @@ static WC_INLINE sp_digit div_2048_word_32(sp_digit d1, sp_digit d0, static WC_INLINE sp_digit div_2048_word_32(sp_digit d1, sp_digit d0, sp_digit div) { - register sp_digit r asm("rax"); + register sp_digit r __asm__("rax"); __asm__ __volatile__ ( "divq %3" : "=a" (r) @@ -3482,7 +3482,7 @@ static WC_INLINE sp_digit div_3072_word_24(sp_digit d1, sp_digit d0, static WC_INLINE sp_digit div_3072_word_24(sp_digit d1, sp_digit d0, sp_digit div) { - register sp_digit r asm("rax"); + register sp_digit r __asm__("rax"); __asm__ __volatile__ ( "divq %3" : "=a" (r) @@ -4165,7 +4165,7 @@ static WC_INLINE sp_digit div_3072_word_48(sp_digit d1, sp_digit d0, static WC_INLINE sp_digit div_3072_word_48(sp_digit d1, sp_digit d0, sp_digit div) { - register sp_digit r asm("rax"); + register sp_digit r __asm__("rax"); __asm__ __volatile__ ( "divq %3" : "=a" (r) @@ -6176,7 +6176,7 @@ static WC_INLINE sp_digit div_4096_word_64(sp_digit d1, sp_digit d0, static WC_INLINE sp_digit div_4096_word_64(sp_digit d1, sp_digit d0, sp_digit div) { - register sp_digit r asm("rax"); + register sp_digit r __asm__("rax"); __asm__ __volatile__ ( "divq %3" : "=a" (r) @@ -24637,7 +24637,7 @@ static WC_INLINE sp_digit div_256_word_4(sp_digit d1, sp_digit d0, static WC_INLINE sp_digit div_256_word_4(sp_digit d1, sp_digit d0, sp_digit div) { - register sp_digit r asm("rax"); + register sp_digit r __asm__("rax"); __asm__ __volatile__ ( "divq %3" : "=a" (r) @@ -49485,7 +49485,7 @@ static WC_INLINE sp_digit div_384_word_6(sp_digit d1, sp_digit d0, static WC_INLINE sp_digit div_384_word_6(sp_digit d1, sp_digit d0, sp_digit div) { - register sp_digit r asm("rax"); + register sp_digit r __asm__("rax"); __asm__ __volatile__ ( "divq %3" : "=a" (r) @@ -90454,7 +90454,7 @@ static WC_INLINE sp_digit div_521_word_9(sp_digit d1, sp_digit d0, static WC_INLINE sp_digit div_521_word_9(sp_digit d1, sp_digit d0, sp_digit div) { - register sp_digit r asm("rax"); + register sp_digit r __asm__("rax"); __asm__ __volatile__ ( "divq %3" : "=a" (r) @@ -92647,7 +92647,7 @@ static WC_INLINE sp_digit div_1024_word_16(sp_digit d1, sp_digit d0, static WC_INLINE sp_digit div_1024_word_16(sp_digit d1, sp_digit d0, sp_digit div) { - register sp_digit r asm("rax"); + register sp_digit r __asm__("rax"); __asm__ __volatile__ ( "divq %3" : "=a" (r) diff --git a/wolfssl/wolfcrypt/ecc.h b/wolfssl/wolfcrypt/ecc.h index d3785827f40..e6a0602d14a 100644 --- a/wolfssl/wolfcrypt/ecc.h +++ b/wolfssl/wolfcrypt/ecc.h @@ -128,6 +128,17 @@ #define MAX_ECC_BITS_NEEDED 112 #endif +/* The bit ECC_KEY_MAX_BITS adds for an order larger than the prime. It is an + * internal sizing detail rather than part of the curve size a user configures, + * so ecc.c folds it into MAX_ECC_BITS_USE and builds ECC_KEY_MAX_BITS from the + * same macro, and MAX_ECC_BITS keeps meaning the plain largest curve. */ +#if defined(WOLFSSL_CUSTOM_CURVES) || (ECC_MIN_KEY_SZ <= 160) || \ + (defined(HAVE_ECC_KOBLITZ) && (ECC_MIN_KEY_SZ <= 224)) + #define MAX_ECC_BITS_EXTRA 1 +#else + #define MAX_ECC_BITS_EXTRA 0 +#endif + #ifndef MAX_ECC_BITS #define MAX_ECC_BITS MAX_ECC_BITS_NEEDED #else @@ -153,6 +164,11 @@ #define MAX_ECC_BYTES ((MAX_ECC_BITS / 8) + 1) #endif +/* Bytes needed to hold a curve order. MAX_ECC_BYTES sizes to the prime, but + * the curves MAX_ECC_BITS_EXTRA covers have an order a bit -- and so a byte -- + * longer than that, e.g. secp160r1 and secp224k1. */ +#define MAX_ECC_ORDER_BYTES (((MAX_ECC_BITS + MAX_ECC_BITS_EXTRA) + 7) / 8) + #ifndef ECC_MAX_PAD_SZ /* ECC maximum padding size (when MSB is set extra byte required for R and S) */ #define ECC_MAX_PAD_SZ 2 diff --git a/wolfssl/wolfcrypt/settings.h b/wolfssl/wolfcrypt/settings.h index b111438a368..ba9a66bf3c0 100644 --- a/wolfssl/wolfcrypt/settings.h +++ b/wolfssl/wolfcrypt/settings.h @@ -3016,8 +3016,14 @@ #define HAVE_AESGCM #endif -/* Detect Cortex M3 (no UMAAL) */ -#if defined(__ARM_ARCH_7M__) && !defined(WOLFSSL_ARM_ARCH_7M) +/* Detect an M-profile core without UMAAL, which selects the UMAAL-free + * variants in sp_cortexm.c and the thumb2-* assembly. That is the Cortex-M3, + * and equally any ARMv8-M part built without the optional DSP extension - a + * case __ARM_ARCH_7M__ alone does not catch. Toolchains define + * __ARM_FEATURE_DSP exactly when the extension, and so UMAAL, is present. */ +#if !defined(WOLFSSL_ARM_ARCH_7M) && !defined(__ARM_FEATURE_DSP) && \ + (defined(__ARM_ARCH_7M__) || \ + (defined(__ARM_ARCH_PROFILE) && (__ARM_ARCH_PROFILE == 'M'))) #define WOLFSSL_ARM_ARCH_7M #endif #if defined(WOLFSSL_SP_ARM_CORTEX_M_ASM) && defined(WOLFSSL_ARM_ARCH_7M) @@ -3099,6 +3105,10 @@ #endif /*(WOLFSSL_APACHE_MYNEWT)*/ #ifdef WOLFSSL_ZEPHYR +/* Assembly sources reach settings.h through libwolfssl_sources_asm.h and need + * only the feature macros. The Zephyr headers below, and the z_realloc + * prototype, are C - without this guard the assembler is handed . */ +#ifndef __ASSEMBLER__ #ifdef __cplusplus } /* extern "C" */ #endif @@ -3171,6 +3181,7 @@ #define CONFIG_NET_SOCKETS_POSIX_NAMES #endif #endif +#endif /* !__ASSEMBLER__ */ #endif /* WOLFSSL_ZEPHYR */ #ifdef WOLFSSL_IMX6 diff --git a/wolfssl/wolfio.h b/wolfssl/wolfio.h index 2194c254c29..a31d5d4fe92 100644 --- a/wolfssl/wolfio.h +++ b/wolfssl/wolfio.h @@ -1057,7 +1057,13 @@ WOLFSSL_API void wolfSSL_SetIOWriteFlags(WOLFSSL* ssl, int flags); #ifndef XHTONS #if !defined(WOLFSSL_NO_SOCK) && (defined(USE_WOLFSSL_IO) || defined(HAVE_HTTP_CLIENT)) - #define XHTONS(a) htons((a)) + #if defined(WOLFSSL_ZEPHYR) && KERNEL_VERSION_NUMBER >= 0x40400 + /* Zephyr 4.4 renamed htons() to net_htons() and brings the old name + * back only under CONFIG_NET_NAMESPACE_COMPAT_MODE. */ + #define XHTONS(a) net_htons((a)) + #else + #define XHTONS(a) htons((a)) + #endif #else /* we don't have sockets, so define our own htons and ntohs */ #ifdef BIG_ENDIAN_ORDER @@ -1069,7 +1075,13 @@ WOLFSSL_API void wolfSSL_SetIOWriteFlags(WOLFSSL* ssl, int flags); #endif #ifndef XNTOHS #if !defined(WOLFSSL_NO_SOCK) && (defined(USE_WOLFSSL_IO) || defined(HAVE_HTTP_CLIENT)) - #define XNTOHS(a) ntohs((a)) + #if defined(WOLFSSL_ZEPHYR) && KERNEL_VERSION_NUMBER >= 0x40400 + /* Zephyr 4.4 renamed ntohs() to net_ntohs() and brings the old name + * back only under CONFIG_NET_NAMESPACE_COMPAT_MODE. */ + #define XNTOHS(a) net_ntohs((a)) + #else + #define XNTOHS(a) ntohs((a)) + #endif #else /* we don't have sockets, so define our own htons and ntohs */ #ifdef BIG_ENDIAN_ORDER diff --git a/zephyr/CMakeLists.txt b/zephyr/CMakeLists.txt index 39f5c58d805..d28559811e3 100644 --- a/zephyr/CMakeLists.txt +++ b/zephyr/CMakeLists.txt @@ -136,53 +136,42 @@ if(CONFIG_WOLFSSL) zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/st/stm32.c) zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/realtek/rtl8735b.c) - if(CONFIG_WOLFCRYPT_ARMASM) - # tested with board: "qemu_kvm_arm64" - if(CONFIG_WOLFCRYPT_ARMASM_THUMB2) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/thumb2-aes-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/thumb2-chacha-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/thumb2-curve25519_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/thumb2-mlkem-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/thumb2-poly1305-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/thumb2-sha256-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/thumb2-sha3-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/thumb2-sha512-asm_c.c) - else() - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-aes-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-chacha-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-curve25519_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-mlkem-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-poly1305-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-sha512-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-sha3-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-sha256-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-32-aes-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-32-chacha-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-32-curve25519_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-32-mlkem-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-32-poly1305-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-32-sha512-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-32-sha3-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-32-sha256-asm_c.c) + if(CONFIG_WOLFCRYPT_ASM) + set(WOLF_ARM_ASM_DIR ${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm) + + # Thumb2 needs UBFX and LDRD, so it is a mainline-only port; ARMv6-M and + # ARMv8-M baseline keep the C code here and take only the SP speedup. + if(CONFIG_ARMV7_M_ARMV8_M_MAINLINE) + set(WOLF_ARM_ASM_PREFIX thumb2) + elseif(CONFIG_ARM64) + set(WOLF_ARM_ASM_PREFIX armv8) + elseif(CONFIG_ARM AND NOT CONFIG_CPU_CORTEX_M) + set(WOLF_ARM_ASM_PREFIX armv8-32) endif() - - # Note: The cmake/gcc-m-cpu.cmake make need updated to add "+crypto -mstrict-align" - set(TOOLCHAIN_C_FLAGS "-mcpu=cortex-a53+crypto -mstrict-align") - endif() - - if(CONFIG_WOLFCRYPT_INTELASM) - # tested with board: "qemu_x86_64" - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha256_asm.S) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha512_asm.S) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha3_asm.S) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/chacha_asm.S) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/poly1305_asm.S) - - # AESNI - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/aes_asm.S) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/aes_gcm_x86_asm.S) - set(TOOLCHAIN_C_FLAGS "-march=native -maes -msse4 -mpclmul ") + if(DEFINED WOLF_ARM_ASM_PREFIX) + foreach(f aes chacha mlkem poly1305 sha256 sha3 sha512) + zephyr_library_sources( + ${WOLF_ARM_ASM_DIR}/${WOLF_ARM_ASM_PREFIX}-${f}-asm_c.c) + endforeach() + # curve25519 is the one port whose file has no "-asm" infix. + zephyr_library_sources( + ${WOLF_ARM_ASM_DIR}/${WOLF_ARM_ASM_PREFIX}-curve25519_c.c) + elseif(CONFIG_X86_64) + # fe_x25519_asm.S, wc_mlkem_asm.S and wc_mldsa_asm.S are here because + # curve25519.c, wc_mlkem_poly.c and wc_mldsa.c all take the Intel path + # whenever USE_INTEL_SPEEDUP is set, so leaving one out is a link error + # the moment an application enables that algorithm. Each is guarded by + # its own feature macro, so it costs an empty object when it is off. + # The AES sources are not here: everything they define is an _aesni + # entry point, and their callers sit behind WOLFSSL_AESNI, which this + # module does not define. + foreach(f sha256_asm sha512_asm sha3_asm chacha_asm poly1305_asm + fe_x25519_asm wc_mlkem_asm wc_mldsa_asm) + zephyr_library_sources( + ${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/${f}.S) + endforeach() + endif() endif() zephyr_library_link_libraries(wolfSSL) diff --git a/zephyr/Kconfig b/zephyr/Kconfig index 1e96b8bf46b..a8259fef9db 100644 --- a/zephyr/Kconfig +++ b/zephyr/Kconfig @@ -61,11 +61,17 @@ config WOLFSSL_SETTINGS_FILE special TLS usage, use available Kconfig settings, or select an alternative config. -rsource "Kconfig.tls-generic" +config WOLFSSL_HAS_SETTINGS_FILE + bool + default y if WOLFSSL_SETTINGS_FILE != "" + help + Set when the application supplies its own wolfSSL settings file. + That file is authoritative, so every option that works by writing a + define into the module's user_settings.h depends on this being clear. config WOLFCRYPT_FIPS bool "wolfCrypt FIPS support" - depends on WOLFSSL_BUILTIN + depends on WOLFSSL_BUILTIN && !WOLFSSL_HAS_SETTINGS_FILE help Enable the wolfCrypt FIPS 140-3 module boundary. Requires the wolfSSL FIPS bundle (fips.c, fips_test.c, wolfcrypt_first.c, wolfcrypt_last.c) @@ -113,6 +119,7 @@ endchoice config WOLFSSL_CRYPTO_ONLY bool "Build wolfCrypt only (no TLS layer)" + depends on !WOLFSSL_HAS_SETTINGS_FILE depends on WOLFSSL_BUILTIN help Define WOLFCRYPT_ONLY: compile only the wolfCrypt crypto library and @@ -120,6 +127,7 @@ config WOLFSSL_CRYPTO_ONLY config WOLFSSL_SINGLE_THREADED bool "wolfCrypt single-threaded" + depends on !WOLFSSL_HAS_SETTINGS_FILE depends on WOLFSSL_BUILTIN default y if !MULTITHREADING help @@ -128,90 +136,178 @@ config WOLFSSL_SINGLE_THREADED on when the kernel has no threading (!MULTITHREADING), so consumers such as wolfPSA do not need to select it themselves. +config WOLFSSL_TLS_VERSION_1_2 + bool "TLS 1.2" + depends on !WOLFSSL_HAS_SETTINGS_FILE + default y + help + Enable TLS 1.2. Clearing this and WOLFSSL_TLS_VERSION_1_3 leaves the + build with no TLS version at all, which only makes sense alongside + WOLFSSL_CRYPTO_ONLY. + +config WOLFSSL_TLS_VERSION_1_3 + bool "TLS 1.3" + depends on !WOLFSSL_HAS_SETTINGS_FILE + default y + help + Enable TLS 1.3 (WOLFSSL_TLS13). + config WOLFSSL_DTLS bool "wolfSSL DTLS support" + depends on !WOLFSSL_HAS_SETTINGS_FILE help Enable DTLS support config WOLFSSL_ALPN bool "wolfSSL ALPN support" + depends on !WOLFSSL_HAS_SETTINGS_FILE help Enable ALPN support config WOLFSSL_PSK bool "wolfSSL PSK support" + depends on !WOLFSSL_HAS_SETTINGS_FILE help Enable PSK support config WOLFSSL_MLKEM bool "wolfSSL PQC ML-KEM support" + depends on !WOLFSSL_HAS_SETTINGS_FILE help Enable PQC ML-KEM support for Key Exchange config WOLFSSL_MLDSA bool "wolfSSL PQC ML-DSA support" + depends on !WOLFSSL_HAS_SETTINGS_FILE help Enable PQC ML-DSA (Dilithium) signatures. config WOLFSSL_LMS bool "wolfSSL LMS/HSS hash-based signatures" + depends on !WOLFSSL_HAS_SETTINGS_FILE help Enable LMS/HSS stateful hash-based signature verification (verify-only). config WOLFSSL_XMSS bool "wolfSSL XMSS/XMSS^MT hash-based signatures" + depends on !WOLFSSL_HAS_SETTINGS_FILE help Enable XMSS/XMSS^MT stateful hash-based signature verification (verify-only). config WOLFSSL_FALCON bool "wolfSSL PQC Falcon signatures" + depends on !WOLFSSL_HAS_SETTINGS_FILE help Enable PQC Falcon (FN-DSA) signatures. config WOLFSSL_RSA bool "wolfCrypt RSA support" + depends on !WOLFSSL_HAS_SETTINGS_FILE default y help Enable RSA (define RSA support; NO_RSA when off). config WOLFSSL_ECC bool "wolfCrypt ECC support" + depends on !WOLFSSL_HAS_SETTINGS_FILE default y help - Enable ECC (HAVE_ECC, SECP256R1). + Enable ECC (HAVE_ECC). At least one curve must be selected below - a + build with none is rejected, because wolfCrypt has no curve table to + size its types from. + +if WOLFSSL_ECC + +config WOLFSSL_ECC_256 + bool "SECP256R1 (P-256)" + default y + help + Enable the NIST P-256 curve. This is the curve TLS uses by default, so + leave it on unless you know the whole application avoids it. + +config WOLFSSL_ECC_384 + bool "SECP384R1 (P-384)" + help + Enable the NIST P-384 curve (HAVE_ECC384 and the SP implementation + behind WOLFSSL_SP_384). + + Enabling a curve larger than P-256 raises MAX_ECC_BYTES, so every ECC + key, signature buffer and temporary grows accordingly - including on the + stack. Size thread stacks for the largest curve selected. + +config WOLFSSL_ECC_512 + bool "512-bit curves" + help + Enable the 512-bit curve size (HAVE_ECC512). There is no NIST curve at + this size - it exists for brainpoolP512r1, so it is only useful together + with WOLFSSL_ECC_BRAINPOOL. SP math has no implementation at this size, + so selecting it forces the generic SP variant. + +config WOLFSSL_ECC_521 + bool "SECP521R1 (P-521)" + help + Enable the NIST P-521 curve (HAVE_ECC521 and the SP implementation + behind WOLFSSL_SP_521). This sets the largest MAX_ECC_BYTES of any + supported curve. + + Its SP implementation is also the most stack-hungry: a thread signing on + P-521 overflowed a 16 KB stack during bring-up and needed roughly three + times that. Raise CONFIG_MAIN_STACK_SIZE and any relevant thread stack, + or set WOLFSSL_SMALL_STACK to move the intermediates onto the heap. + +config WOLFSSL_ECC_BRAINPOOL + bool "Brainpool curves" + help + Enable the Brainpool curve family (HAVE_ECC_BRAINPOOL). Each curve also + needs its matching size enabled: brainpoolP256r1 needs WOLFSSL_ECC_256, + brainpoolP384r1 needs WOLFSSL_ECC_384 and brainpoolP512r1 needs + WOLFSSL_ECC_512. + + Implies WOLFSSL_CUSTOM_CURVES, which wolfCrypt requires for any + non-prime-field curve, and that moves the whole build onto the generic + SP variant - slower and larger on the common curves, which is why this + is opt-in. + +endif # WOLFSSL_ECC config WOLFSSL_CHACHA_POLY bool "wolfCrypt ChaCha20-Poly1305 support" + depends on !WOLFSSL_HAS_SETTINGS_FILE default y help Enable ChaCha20 and Poly1305 (HAVE_CHACHA, HAVE_POLY1305). config WOLFSSL_CURVE25519 bool "wolfCrypt Curve25519 / Ed25519 support" + depends on !WOLFSSL_HAS_SETTINGS_FILE default n help Enable Curve25519 and Ed25519 (HAVE_CURVE25519, HAVE_ED25519). config WOLFSSL_SNI bool "wolfSSL Server Name Indication (SNI)" + depends on !WOLFSSL_HAS_SETTINGS_FILE default y help Enable TLS Server Name Indication (HAVE_SNI). config WOLFSSL_SESSION_CACHE bool "wolfSSL TLS session cache" + depends on !WOLFSSL_HAS_SETTINGS_FILE default y help Enable the TLS session cache (SMALL_SESSION_CACHE; NO_SESSION_CACHE off). config WOLFSSL_SESSION_TICKET bool "wolfSSL TLS session tickets" + depends on !WOLFSSL_HAS_SETTINGS_FILE default y help Enable TLS session tickets (HAVE_SESSION_TICKET, TLS 1.3 resumption). config WOLFSSL_MAX_FRAGMENT_LEN int + depends on !WOLFSSL_HAS_SETTINGS_FILE default 3 range 1 6 help @@ -220,44 +316,78 @@ config WOLFSSL_MAX_FRAGMENT_LEN config WOLFSSL_SESSION_EXPORT bool "wolfSSL session export support" + depends on !WOLFSSL_HAS_SETTINGS_FILE help Enable external session cache (HAVE_EXT_CACHE) config WOLFSSL_KEEP_PEER_CERT bool "wolfSSL keep peer certificate support" + depends on !WOLFSSL_HAS_SETTINGS_FILE help Retain peer certificate after handshake (KEEP_PEER_CERT) config WOLFSSL_ALWAYS_VERIFY_CB bool "wolfSSL always invoke verify callback" + depends on !WOLFSSL_HAS_SETTINGS_FILE help Invoke verify callback on success as well as failure (WOLFSSL_ALWAYS_VERIFY_CB) config WOLFSSL_OPENSSL_EXTRA_X509_SMALL bool "wolfSSL minimal X509 compat APIs" + depends on !WOLFSSL_HAS_SETTINGS_FILE help Define OPENSSL_EXTRA_X509_SMALL. Exposes a small subset of X509 helpers (wolfSSL_X509_free, wolfSSL_get_verify_result, ...) without the rest of OPENSSL_EXTRA. -config WOLFCRYPT_ARMASM - bool "wolfCrypt ARM Assembly support" - depends on WOLFSSL_BUILTIN +config WOLFCRYPT_ASM + bool "wolfCrypt assembly optimisations" + depends on WOLFSSL_BUILTIN && !WOLFSSL_HAS_SETTINGS_FILE + depends on ARM || ARM64 || X86_64 help - wolfCrypt ARM (ARMv8/ARMv7) assembly support for AES, SHA-2, SHA-3, - ChaCha20/Poly1305 and Curve25519 - -config WOLFCRYPT_ARMASM_THUMB2 - bool "wolfCrypt ARM Thumb2 Assembly support" - depends on WOLFCRYPT_ARMASM + Use the hand-written assembly for the symmetric algorithms (AES, + SHA-2, SHA-3, ChaCha20/Poly1305, Curve25519) and, on ARM, for the + single-precision math behind RSA, DH and ECC. + + The port follows the CPU Zephyr reports: + + ARMv7-M / ARMv8-M mainline thumb2 symmetric, Cortex-M math + ARMv6-M / ARMv8-M baseline math only, Thumb variant + 32-bit Cortex-A / Cortex-R armv8-32 symmetric, ARM32 math + AArch64 armv8 symmetric, ARM64 math + x86_64 symmetric only + + ARMv6-M and ARMv8-M baseline get no symmetric assembly because the + Thumb2 port uses UBFX and LDRD, which those cores lack. On the + mainline cores the math assembly prefers UMAAL, part of the DSP + extension; a part built without it takes the slower UMAAL-free + variant of the same routines. + + x86_64 gets no single-precision assembly: sp_x86_64_asm.S is AVX + throughout and sp_x86_64.c calls it without a CPUID check, while + Zephyr's x86 context switch never enables the YMM state. Its + symmetric AVX1/AVX2 paths are safe because they are chosen at run + time by CPUID, which this module also teaches to check that the OS + enabled the vector state. + + 32-bit x86 is not offered: only the AES sources have an + implementation at that width, and the rest are guarded to x86_64. + +config WOLFCRYPT_SP_SMALL + bool "Smaller single-precision math" + depends on WOLFSSL_BUILTIN && !WOLFSSL_HAS_SETTINGS_FILE + default y help - Enable Thumb2 assembly optimizations for ARM processors + Build the space-optimised variant of the single-precision math + backend. Turning it off trades a markedly larger image for faster + RSA, DH and ECC. -config WOLFCRYPT_INTELASM - bool "wolfCrypt Intel Assembly support" - depends on WOLFSSL_BUILTIN - help - wolfCrypt Intel Aassembly support (AVX/AVX2/AESNI) + Independent of WOLFCRYPT_ASM, which picks the backend while this + picks the variant within it: the assembly sources carry both a + loop-based and an unrolled form of each routine. Leaving this on + therefore keeps the smaller, slower half of the assembly, so + turning it off is what makes WOLFCRYPT_ASM pay off on a part with + the flash to spare. config WOLFSSL_NO_HAVE_MIN_MAX bool "Force wolfSSL to use its own min/max" @@ -282,6 +412,10 @@ config WOLFSSL_INSTALL_PATH installed. Make sure this option is properly set when WOLFSSL_LIBRARY is enabled otherwise the build will fail. +module = WOLFSSL +module-str = wolfssl +source "subsys/logging/Kconfig.template.log_config" + config APP_LINK_WITH_WOLFSSL bool "Link 'app' with WOLFSSL" default y diff --git a/zephyr/Kconfig.tls-generic b/zephyr/Kconfig.tls-generic deleted file mode 100644 index bc46a8fd47d..00000000000 --- a/zephyr/Kconfig.tls-generic +++ /dev/null @@ -1,267 +0,0 @@ -# Kconfig.tls - TLS/DTLS related options - -# -# Copyright (c) 2018 Intel Corporation -# Copyright (c) 2018 Nordic Semiconductor ASA -# -# SPDX-License-Identifier: Apache-2.0 -# - -menu "TLS configuration" - -menu "Supported TLS version" - -config WOLFSSL_TLS_VERSION_1_0 - bool "Enable support for TLS 1.0" - select WOLFSSL_ALLOW_TLSV10_ENABLED - -config WOLFSSL_TLS_VERSION_1_1 - bool "Enable support for TLS 1.1" - select WOLFSSL_NO_OLD_TLS_DISABLED - -config WOLFSSL_TLS_VERSION_1_2 - bool "Enable support for TLS 1.2" - default y - -config WOLFSSL_TLS_VERSION_1_3 - bool "Enable support for TLS 1.3" - select WOLFSSL_TLS13_ENABLED - -endmenu - -menu "Ciphersuite configuration" - -comment "Supported key exchange modes" - -config WOLFSSL_KEY_EXCHANGE_ALL_ENABLED - bool "Enable all available ciphersuite modes" - select WOLFSSL_KEY_EXCHANGE_PSK_ENABLED - select WOLFSSL_KEY_EXCHANGE_DHE_PSK_ENABLED - select WOLFSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED - select WOLFSSL_KEY_EXCHANGE_RSA_PSK_ENABLED - select WOLFSSL_KEY_EXCHANGE_RSA_ENABLED - select WOLFSSL_KEY_EXCHANGE_DHE_RSA_ENABLED - select WOLFSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED - select WOLFSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED - select WOLFSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED - select WOLFSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED - select WOLFSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED - select WOLFSSL_KEY_EXCHANGE_ECJPAKE_ENABLED - -config WOLFSSL_KEY_EXCHANGE_PSK_ENABLED - bool "Enable the PSK based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_DHE_PSK_ENABLED - bool "Enable the DHE-PSK based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED - bool "Enable the ECDHE-PSK based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_RSA_PSK_ENABLED - bool "Enable the RSA-PSK based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_RSA_ENABLED - bool "Enable the RSA-only based ciphersuite modes" - default y - -config WOLFSSL_KEY_EXCHANGE_DHE_RSA_ENABLED - bool "Enable the DHE-RSA based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED - bool "Enable the ECDHE-RSA based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED - bool "Enable the ECDHE-ECDSA based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED - bool "Enable the ECDH-ECDSA based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED - bool "Enable the ECDH-RSA based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_ECJPAKE_ENABLED - bool "Enable the ECJPAKE based ciphersuite modes" - -if WOLFSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED || \ - WOLFSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED || \ - WOLFSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED || \ - WOLFSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED || \ - WOLFSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED || \ - WOLFSSL_KEY_EXCHANGE_ECJPAKE_ENABLED - -comment "Supported elliptic curves" - -config WOLFSSL_ECP_ALL_ENABLED - bool "Enable all available elliptic curves" - select WOLFSSL_ECP_DP_SECP192R1_ENABLED - select WOLFSSL_ECP_DP_SECP192R1_ENABLED - select WOLFSSL_ECP_DP_SECP224R1_ENABLED - select WOLFSSL_ECP_DP_SECP256R1_ENABLED - select WOLFSSL_ECP_DP_SECP384R1_ENABLED - select WOLFSSL_ECP_DP_SECP521R1_ENABLED - select WOLFSSL_ECP_DP_SECP192K1_ENABLED - select WOLFSSL_ECP_DP_SECP224K1_ENABLED - select WOLFSSL_ECP_DP_SECP256K1_ENABLED - select WOLFSSL_ECP_DP_BP256R1_ENABLED - select WOLFSSL_ECP_DP_BP384R1_ENABLED - select WOLFSSL_ECP_DP_BP512R1_ENABLED - select WOLFSSL_ECP_DP_CURVE25519_ENABLED - select WOLFSSL_ECP_DP_CURVE448_ENABLED - select WOLFSSL_ECP_NIST_OPTIM - -config WOLFSSL_ECP_DP_SECP192R1_ENABLED - bool "Enable SECP192R1 elliptic curve" - -config WOLFSSL_ECP_DP_SECP224R1_ENABLED - bool "Enable SECP224R1 elliptic curve" - -config WOLFSSL_ECP_DP_SECP256R1_ENABLED - bool "Enable SECP256R1 elliptic curve" - -config WOLFSSL_ECP_DP_SECP384R1_ENABLED - bool "Enable SECP384R1 elliptic curve" - -config WOLFSSL_ECP_DP_SECP521R1_ENABLED - bool "Enable SECP521R1 elliptic curve" - -config WOLFSSL_ECP_DP_SECP192K1_ENABLED - bool "Enable SECP192K1 elliptic curve" - -config WOLFSSL_ECP_DP_SECP224K1_ENABLED - bool "Enable SECP224K1 elliptic curve" - -config WOLFSSL_ECP_DP_SECP256K1_ENABLED - bool "Enable SECP256K1 elliptic curve" - -config WOLFSSL_ECP_DP_BP256R1_ENABLED - bool "Enable BP256R1 elliptic curve" - -config WOLFSSL_ECP_DP_BP384R1_ENABLED - bool "Enable BP384R1 elliptic curve" - -config WOLFSSL_ECP_DP_BP512R1_ENABLED - bool "Enable BP512R1 elliptic curve" - -config WOLFSSL_ECP_DP_CURVE25519_ENABLED - bool "Enable CURVE25519 elliptic curve" - -config WOLFSSL_ECP_DP_CURVE448_ENABLED - bool "Enable CURVE448 elliptic curve" - -config WOLFSSL_ECP_NIST_OPTIM - bool "Enable NSIT curves optimization" - -endif - -comment "Supported cipher modes" - -config WOLFSSL_CIPHER_ALL_ENABLED - bool "Enable all available ciphers" - select WOLFSSL_CIPHER_AES_ENABLED - select WOLFSSL_CIPHER_CAMELLIA_ENABLED - select WOLFSSL_CIPHER_DES_ENABLED - select WOLFSSL_CIPHER_ARC4_ENABLED - select WOLFSSL_CIPHER_CHACHA20_ENABLED - select WOLFSSL_CIPHER_BLOWFISH_ENABLED - select WOLFSSL_CIPHER_CCM_ENABLED - select WOLFSSL_CIPHER_MODE_XTS_ENABLED - select WOLFSSL_CIPHER_MODE_GCM_ENABLED - select WOLFSSL_CIPHER_CBC_ENABLED - select WOLFSSL_CHACHAPOLY_AEAD_ENABLED - -config WOLFSSL_CIPHER_AES_ENABLED - bool "Enable the AES block cipher" - default y - -config WOLFSSL_AES_ROM_TABLES - depends on WOLFSSL_CIPHER_AES_ENABLED - bool "Use precomputed AES tables stored in ROM." - default y - -config WOLFSSL_CIPHER_CAMELLIA_ENABLED - bool "Enable the Camellia block cipher" - -config WOLFSSL_CIPHER_DES_ENABLED - bool "Enable the DES block cipher" - default y - -config WOLFSSL_CIPHER_ARC4_ENABLED - bool "Enable the ARC4 stream cipher" - -config WOLFSSL_CIPHER_CHACHA20_ENABLED - bool "Enable the ChaCha20 stream cipher" - -config WOLFSSL_CIPHER_BLOWFISH_ENABLED - bool "Enable the Blowfish block cipher" - -config WOLFSSL_CIPHER_CCM_ENABLED - bool "Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher" - depends on WOLFSSL_CIPHER_AES_ENABLED || WOLFSSL_CIPHER_CAMELLIA_ENABLED - -config WOLFSSL_CIPHER_MODE_XTS_ENABLED - bool "Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES" - depends on WOLFSSL_CIPHER_AES_ENABLED || WOLFSSL_CIPHER_CAMELLIA_ENABLED - -config WOLFSSL_CIPHER_MODE_GCM_ENABLED - bool "Enable the Galois/Counter Mode (GCM) for AES" - depends on WOLFSSL_CIPHER_AES_ENABLED || WOLFSSL_CIPHER_CAMELLIA_ENABLED - -config WOLFSSL_CIPHER_CBC_ENABLED - bool "Enable Cipher Block Chaining mode (CBC) for symmetric ciphers" - default y - -config WOLFSSL_CHACHAPOLY_AEAD_ENABLED - bool "Enable the ChaCha20-Poly1305 AEAD algorithm" - depends on WOLFSSL_CIPHER_CHACHA20_ENABLED || WOLFSSL_MAC_POLY1305_ENABLED - -comment "Supported message authentication methods" - -config WOLFSSL_MAC_ALL_ENABLED - bool "Enable all available MAC methods" - select WOLFSSL_MAC_MD4_ENABLED - select WOLFSSL_MAC_MD5_ENABLED - select WOLFSSL_MAC_SHA1_ENABLED - select WOLFSSL_MAC_SHA256_ENABLED - select WOLFSSL_MAC_SHA512_ENABLED - select WOLFSSL_MAC_POLY1305_ENABLED - -config WOLFSSL_MAC_MD4_ENABLED - bool "Enable the MD4 hash algorithm" - -config WOLFSSL_MAC_MD5_ENABLED - bool "Enable the MD5 hash algorithm" - default y - -config WOLFSSL_MAC_SHA1_ENABLED - bool "Enable the SHA1 hash algorithm" - default y - -config WOLFSSL_MAC_SHA256_ENABLED - bool "Enable the SHA-224 and SHA-256 hash algorithms" - default y - -config WOLFSSL_MAC_SHA512_ENABLED - bool "Enable the SHA-384 and SHA-512 hash algorithms" - -config WOLFSSL_MAC_POLY1305_ENABLED - bool "Enable the Poly1305 MAC algorithm" - -endmenu - -comment "Random number generators" - -config WOLFSSL_HMAC_DRBG_ENABLED - bool "Enable the HMAC_DRBG random generator" - default y - -comment "Other configurations" - -config WOLFSSL_HAVE_ASM - bool "Enable use of assembly code" - default y - help - Enable use of assembly code in wolfSSL. This improves the performances - of asymmetric cryptography, however this might have an impact on the - code size. - -endmenu diff --git a/zephyr/include.am b/zephyr/include.am index 6c602ecd258..49cbb306dd4 100644 --- a/zephyr/include.am +++ b/zephyr/include.am @@ -4,7 +4,6 @@ EXTRA_DIST+= zephyr/CMakeLists.txt EXTRA_DIST+= zephyr/Kconfig -EXTRA_DIST+= zephyr/Kconfig.tls-generic EXTRA_DIST+= zephyr/zephyr_init.c EXTRA_DIST+= zephyr/module.yml EXTRA_DIST+= zephyr/wolfssl/options.h diff --git a/zephyr/samples/wolfssl_benchmark/prj.conf b/zephyr/samples/wolfssl_benchmark/prj.conf index a29977e91d2..b4d9b2dd57b 100644 --- a/zephyr/samples/wolfssl_benchmark/prj.conf +++ b/zephyr/samples/wolfssl_benchmark/prj.conf @@ -28,6 +28,5 @@ CONFIG_TEST_RANDOM_GENERATOR=y CONFIG_ENTROPY_GENERATOR=y CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y -# Optional ARM or Intel Assembly -#CONFIG_WOLFCRYPT_ARMASM=y -#CONFIG_WOLFCRYPT_INTELASM=y +# Optional ARM assembly +#CONFIG_WOLFCRYPT_ASM=y diff --git a/zephyr/samples/wolfssl_test/prj-ecc-custom.conf b/zephyr/samples/wolfssl_test/prj-ecc-custom.conf new file mode 100644 index 00000000000..7dd1057215b --- /dev/null +++ b/zephyr/samples/wolfssl_test/prj-ecc-custom.conf @@ -0,0 +1,15 @@ +# The custom-curve path: Brainpool requires WOLFSSL_CUSTOM_CURVES, which +# cannot coexist with the per-curve SP backend, so the module moves the whole +# build onto the generic one. Covers the 512 size, which exists only for +# brainpoolP512r1. Layered on top of prj.conf via CONF_FILE in sample.yaml. + +CONFIG_WOLFSSL_ECC=y +CONFIG_WOLFSSL_ECC_256=y +CONFIG_WOLFSSL_ECC_384=y +CONFIG_WOLFSSL_ECC_512=y +CONFIG_WOLFSSL_ECC_BRAINPOOL=y + +CONFIG_MAIN_STACK_SIZE=65536 + +# The generic backend allocates more per operation than the per-curve one. +CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=65536 diff --git a/zephyr/samples/wolfssl_test/prj-ecc-nist.conf b/zephyr/samples/wolfssl_test/prj-ecc-nist.conf new file mode 100644 index 00000000000..2d1886da409 --- /dev/null +++ b/zephyr/samples/wolfssl_test/prj-ecc-nist.conf @@ -0,0 +1,20 @@ +# P-256 plus the two larger NIST curves, WITHOUT any custom-curve option. +# +# This combination is the one worth pinning: each larger curve needs its own +# SP implementation switch, and selecting the curve alone leaves it in +# wolfCrypt's table with no math behind it - a build that succeeds and then +# fails at runtime with WC_KEY_SIZE_E. Enabling Brainpool here would mask +# exactly that, because it forces the generic SP backend, which handles every +# curve. +# Layered on top of prj.conf via CONF_FILE in sample.yaml. + +CONFIG_WOLFSSL_ECC=y +CONFIG_WOLFSSL_ECC_256=y +CONFIG_WOLFSSL_ECC_384=y +CONFIG_WOLFSSL_ECC_521=y + +# P-521's SP path is markedly more stack-hungry than the smaller curves. +CONFIG_MAIN_STACK_SIZE=65536 + +# PKCS12 in the full suite needs more heap than the base sample allows. +CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=65536 diff --git a/zephyr/samples/wolfssl_test/sample.yaml b/zephyr/samples/wolfssl_test/sample.yaml index e9fbbcdd24d..64119403d74 100644 --- a/zephyr/samples/wolfssl_test/sample.yaml +++ b/zephyr/samples/wolfssl_test/sample.yaml @@ -19,3 +19,68 @@ tests: extra_args: CONF_FILE="prj-no-malloc.conf" integration_platforms: - qemu_x86 + sample.crypto.wolfssl_test_ecc_nist: + timeout: 400 + platform_allow: qemu_x86 + extra_args: CONF_FILE="prj.conf;prj-ecc-nist.conf" + integration_platforms: + - qemu_x86 + sample.crypto.wolfssl_test_ecc_custom: + # Brainpool forces the generic SP backend, which is slower than the + # per-curve one, and this runs the whole suite over every curve under QEMU. + timeout: 600 + platform_allow: qemu_x86 + extra_args: CONF_FILE="prj.conf;prj-ecc-custom.conf" + integration_platforms: + - qemu_x86 + # One scenario per assembly port CONFIG_WOLFCRYPT_ASM can select, so a + # regression in the generated sources or in the arch dispatch fails here + # rather than on hardware. + sample.crypto.wolfssl_test_asm_x86_64: + # qemu_x86_64 advertises no AVX, so this also exercises the CPUID fallback + # that keeps the Intel sources off a CPU whose OS never enabled the vector + # state. + timeout: 400 + platform_allow: qemu_x86_64 + extra_configs: + - CONFIG_WOLFCRYPT_ASM=y + - CONFIG_MAIN_STACK_SIZE=65536 + - CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=65536 + integration_platforms: + - qemu_x86_64 + sample.crypto.wolfssl_test_asm_aarch64: + # The ARMv8 symmetric port plus the ARM64 math one, at the board's own + # -mcpu. Plain ARMv8-A has no crypto extension, so user_settings.h opts out + # of the hardware paths and this covers the software ones. + timeout: 900 + platform_allow: qemu_cortex_a53 + extra_configs: + - CONFIG_WOLFCRYPT_ASM=y + - CONFIG_MAIN_STACK_SIZE=65536 + - CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=65536 + integration_platforms: + - qemu_cortex_a53 + sample.crypto.wolfssl_test_asm_aarch64_crypto: + # The same port with the crypto extension named, which is what turns the + # hardware paths on. Covers the .arch_extension directives the generated + # files carry, which a plain ARMv8-A -mcpu rejects without them. + timeout: 900 + platform_allow: qemu_cortex_a53 + extra_configs: + - CONFIG_WOLFCRYPT_ASM=y + - CONFIG_MAIN_STACK_SIZE=65536 + - CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=65536 + - CONFIG_COMPILER_OPT="-mcpu=cortex-a53+crypto" + integration_platforms: + - qemu_cortex_a53 + sample.crypto.wolfssl_test_asm_thumb2: + # AN521 is a Cortex-M33, so this is the Thumb2 symmetric port plus the + # Cortex-M math one - the pair every ARMv8-M mainline target takes. + timeout: 1800 + platform_allow: mps2/an521/cpu0 + extra_configs: + - CONFIG_WOLFCRYPT_ASM=y + - CONFIG_MAIN_STACK_SIZE=65536 + - CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=65536 + integration_platforms: + - mps2/an521/cpu0 diff --git a/zephyr/samples/wolfssl_tls_sock/prj-no-malloc.conf b/zephyr/samples/wolfssl_tls_sock/prj-no-malloc.conf index d14a77e3b54..2126c4c6035 100644 --- a/zephyr/samples/wolfssl_tls_sock/prj-no-malloc.conf +++ b/zephyr/samples/wolfssl_tls_sock/prj-no-malloc.conf @@ -40,8 +40,3 @@ CONFIG_WOLFSSL_SETTINGS_FILE="user_settings-no-malloc.h" CONFIG_WOLFSSL=y CONFIG_WOLFSSL_BUILTIN=y -CONFIG_WOLFSSL_TLS_VERSION_1_2=y -CONFIG_WOLFSSL_KEY_EXCHANGE_ALL_ENABLED=y -CONFIG_WOLFSSL_CIPHER_ALL_ENABLED=y -CONFIG_WOLFSSL_MAC_ALL_ENABLED=y -CONFIG_WOLFSSL_HMAC_DRBG_ENABLED=y diff --git a/zephyr/samples/wolfssl_tls_sock/prj.conf b/zephyr/samples/wolfssl_tls_sock/prj.conf index 998475f52f2..a4e0e61b37e 100644 --- a/zephyr/samples/wolfssl_tls_sock/prj.conf +++ b/zephyr/samples/wolfssl_tls_sock/prj.conf @@ -41,8 +41,4 @@ CONFIG_WOLFSSL=y CONFIG_WOLFSSL_BUILTIN=y CONFIG_WOLFSSL_TLS_VERSION_1_3=y -CONFIG_WOLFSSL_KEY_EXCHANGE_ALL_ENABLED=y -CONFIG_WOLFSSL_CIPHER_ALL_ENABLED=y -CONFIG_WOLFSSL_MAC_ALL_ENABLED=y -CONFIG_WOLFSSL_HMAC_DRBG_ENABLED=y CONFIG_WOLFSSL_MLKEM=y diff --git a/zephyr/samples/wolfssl_tls_thread/prj.conf b/zephyr/samples/wolfssl_tls_thread/prj.conf index b2b48c98c15..4c6910f2a42 100644 --- a/zephyr/samples/wolfssl_tls_thread/prj.conf +++ b/zephyr/samples/wolfssl_tls_thread/prj.conf @@ -31,8 +31,4 @@ CONFIG_WOLFSSL=y CONFIG_WOLFSSL_BUILTIN=y CONFIG_WOLFSSL_TLS_VERSION_1_3=y -CONFIG_WOLFSSL_KEY_EXCHANGE_ALL_ENABLED=y -CONFIG_WOLFSSL_CIPHER_ALL_ENABLED=y -CONFIG_WOLFSSL_MAC_ALL_ENABLED=y -CONFIG_WOLFSSL_HMAC_DRBG_ENABLED=y CONFIG_WOLFSSL_MLKEM=y diff --git a/zephyr/user_settings.h b/zephyr/user_settings.h index caacdd2e116..2dc565335fc 100644 --- a/zephyr/user_settings.h +++ b/zephyr/user_settings.h @@ -185,7 +185,7 @@ extern "C" { //#define NO_WOLFSSL_CLIENT /* Optionally disable TLS client code */ /* TLS v1.3 */ -#if defined(CONFIG_WOLFSSL_TLS_VERSION_1_3) || defined(CONFIG_WOLFSSL_TLS13_ENABLED) +#ifdef CONFIG_WOLFSSL_TLS_VERSION_1_3 #define WOLFSSL_TLS13 #endif @@ -303,15 +303,41 @@ extern "C" { /* ECC */ #if defined(CONFIG_WOLFSSL_ECC) #define HAVE_ECC - #define ECC_USER_CURVES /* Enable only ECC curves specific */ - #undef NO_ECC256 /* Enable SECP256R1 only (on by default) */ + #define ECC_USER_CURVES /* only the curves selected below */ #define ECC_TIMING_RESISTANT /* Enable Timing Resistance */ + #if defined(CONFIG_WOLFSSL_ECC_256) + #undef NO_ECC256 + #else + #define NO_ECC256 + #endif + #if defined(CONFIG_WOLFSSL_ECC_384) + #define HAVE_ECC384 + #endif + #if defined(CONFIG_WOLFSSL_ECC_512) + #define HAVE_ECC512 + #endif + #if defined(CONFIG_WOLFSSL_ECC_521) + #define HAVE_ECC521 + #endif + /* Brainpool curves are not prime-field NIST curves, and wolfCrypt refuses + * to build them without custom-curve support - a hard #error in ecc.c. */ + #if defined(CONFIG_WOLFSSL_ECC_BRAINPOOL) + #define WOLFSSL_CUSTOM_CURVES + #define HAVE_ECC_BRAINPOOL + #endif + + #if defined(NO_ECC256) && !defined(HAVE_ECC384) && \ + !defined(HAVE_ECC512) && !defined(HAVE_ECC521) + /* Otherwise MAX_ECC_BITS_NEEDED never gets defined and the failure + * surfaces as an undeclared identifier inside ecc.h, pointing nowhere + * near the configuration choice that caused it. */ + #error "CONFIG_WOLFSSL_ECC requires at least one curve to be selected" + #endif + //#define ECC_SHAMIR /* Optional ECC calculation speed improvement if not using SP implementation */ - //#define WOLFSSL_CUSTOM_CURVES /* enable other curves (not just prime) */ //#define HAVE_ECC_SECPR2 //#define HAVE_ECC_SECPR3 - //#define HAVE_ECC_BRAINPOOL //#define HAVE_ECC_KOBLITZ //#define HAVE_ECC_CDH /* Co-factor */ //#define HAVE_COMP_KEY /* Compressed key support */ @@ -464,8 +490,14 @@ extern "C" { #define WOLFSSL_HAVE_MLKEM #define WOLFSSL_MLKEM_NO_LARGE_CODE #define WOLFSSL_MLKEM_SMALL - #define WOLFSSL_MLKEM_MAKEKEY_SMALL_MEM - #define WOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM + /* The Intel and AArch64 ML-KEM assembly has no small-memory variant of + * key generation or encapsulation, and wc_mlkem.c rejects the pair with an + * #error rather than falling back. */ + #if !defined(CONFIG_WOLFCRYPT_ASM) || \ + !(defined(CONFIG_X86_64) || defined(CONFIG_ARM64)) + #define WOLFSSL_MLKEM_MAKEKEY_SMALL_MEM + #define WOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM + #endif #define WOLFSSL_MLKEM_DYNAMIC_KEYS #endif @@ -520,7 +552,14 @@ extern "C" { /* Math Options */ /* Multi-precision - generic math for all keys sizes and curves */ #if 1 - #define WOLFSSL_SP_MATH /* no multi-precision math, only single */ + /* SP has no implementation for the 512-bit size and no path for an + * arbitrary curve. Neither is a build failure - every operation fails at + * runtime with WC_KEY_SIZE_E - so move to the generic variant instead. */ + #if defined(WOLFSSL_CUSTOM_CURVES) || defined(HAVE_ECC512) + #define WOLFSSL_SP_MATH_ALL + #else + #define WOLFSSL_SP_MATH /* no multi-precision math, only single */ + #endif #elif 1 /* wolf mp math (sp_int.c) */ #define WOLFSSL_SP_MATH_ALL /* use SP math for all key sizes and curves */ @@ -563,9 +602,17 @@ extern "C" { #if 1 #ifdef HAVE_ECC #define WOLFSSL_HAVE_SP_ECC - //#define WOLFSSL_SP_NO_256 - //#define WOLFSSL_SP_384 - //#define WOLFSSL_SP_521 + /* Selecting a curve without its SP switch leaves it in wolfCrypt's + * table with no math behind it and no build diagnostic. */ + #if defined(NO_ECC256) + #define WOLFSSL_SP_NO_256 + #endif + #if defined(HAVE_ECC384) + #define WOLFSSL_SP_384 + #endif + #if defined(HAVE_ECC521) + #define WOLFSSL_SP_521 + #endif #endif #ifndef NO_RSA #define WOLFSSL_HAVE_SP_RSA @@ -577,17 +624,31 @@ extern "C" { #define WOLFSSL_HAVE_SP_DH #endif - #define WOLFSSL_SP_SMALL /* use smaller version of code */ + #ifdef CONFIG_WOLFCRYPT_SP_SMALL + #define WOLFSSL_SP_SMALL /* use smaller version of code */ + #endif //#define WOLFSSL_SP_NO_MALLOC /* disable heap in wolf/SP math */ //#define SP_DIV_WORD_USE_DIV /* no div64 */ - #if 0 - /* optional speedup with inline assembly */ - //#define WOLFSSL_SP_ARM_CORTEX_M_ASM /* Cortex-M3+ */ - //#define WOLFSSL_SP_ARM_THUMB_ASM /* Cortex-M0+ thumb */ - //#define WOLFSSL_SP_ARM32_ASM /* Cortex-R */ - //#define WOLFSSL_SP_ARM64_ASM /* Cortex-A */ - //#define WOLFSSL_SP_USE_UDIV + /* Assembly speedup, keyed on the CPU Zephyr reports. Anything not named + * here keeps the C backend. Each pair is two separate backends: the _ASM + * macro compiles sp_.c for the RSA, DH and ECC sizes it covers, the + * other the word primitives sp_int.c uses for everything else. */ + #ifdef CONFIG_WOLFCRYPT_ASM + #if defined(CONFIG_ARMV6_M_ARMV8_M_BASELINE) + #define WOLFSSL_SP_ARM_THUMB_ASM + #define WOLFSSL_SP_ARM_THUMB + #elif defined(CONFIG_ARMV7_M_ARMV8_M_MAINLINE) + #define WOLFSSL_SP_ARM_CORTEX_M_ASM + #define WOLFSSL_SP_ARM_CORTEX_M + #elif defined(CONFIG_ARM64) + #define WOLFSSL_SP_ARM64_ASM + #define WOLFSSL_SP_ARM64 + #elif defined(CONFIG_CPU_AARCH32_CORTEX_R) || \ + defined(CONFIG_CPU_AARCH32_CORTEX_A) + #define WOLFSSL_SP_ARM32_ASM + #define WOLFSSL_SP_ARM32 + #endif #endif #endif @@ -595,27 +656,49 @@ extern "C" { /* Assembly Speedups for Symmetric Algorithms */ /* ------------------------------------------------------------------------- */ -#ifdef CONFIG_WOLFCRYPT_ARMASM +#ifdef CONFIG_WOLFCRYPT_ASM +/* Mirrors the source selection in CMakeLists.txt. ARMv6-M and ARMv8-M + * baseline are absent from both: the Thumb2 port uses UBFX and LDRD, which + * those cores do not have, so they keep the C code and the SP speedup only. */ +#if defined(CONFIG_ARMV7_M_ARMV8_M_MAINLINE) || defined(CONFIG_ARM64) || \ + (defined(CONFIG_ARM) && !defined(CONFIG_CPU_CORTEX_M)) #define WOLFSSL_ARMASM #define WOLFSSL_NO_HASH_RAW #define WOLFSSL_ARMASM_INLINE /* use inline .c versions */ #define WOLFSSL_ARMASM_NO_NEON - /* Default is ARMv8 */ + /* Without this the Thumb2 sources compile but every caller still takes + * the ARMv8 path, so the port selects files and nothing else. */ + #ifdef CONFIG_CPU_CORTEX_M + #define WOLFSSL_ARMASM_THUMB2 + #endif - #if 0 /* ARMv7 */ - #define WOLFSSL_ARM_ARCH 7 - #define WOLFSSL_ARMASM_NO_HW_CRYPTO /* enable if processor does not support aes/sha instructions */ + /* AArch32 assembles its hardware crypto blocks only when the -mcpu Zephyr + * derives from the board already has the extension; AArch64 carries its + * own .arch_extension and always assembles them, and cpuid.c then claims + * AES, PMULL and SHA-256 unless this is set, so aese traps on a core + * without them. */ + #ifndef __ARM_FEATURE_CRYPTO + #define WOLFSSL_ARMASM_NO_HW_CRYPTO #endif -#endif -#ifdef CONFIG_WOLFCRYPT_INTELASM + /* Nothing probes the CPU on bare metal, so cpuid.c claims RDMA whenever + * this is not set and mlkem_keygen() runs sqrdmlsh on a core without it. */ + #if defined(CONFIG_ARM64) && !defined(__ARM_FEATURE_QRDMX) + #define WOLFSSL_AARCH64_NO_SQRDMLSH + #endif +#elif defined(CONFIG_X86_64) #define USE_INTEL_SPEEDUP - #define WOLFSSL_X86_64_BUILD /* 64-bit */ - //#define WOLFSSL_X86_BUILD /* 32-bit */ + #define WOLFSSL_X86_64_BUILD +#endif - /* Issues with building AESNI "_mm_aesimc_si128" always_inline */ - //#define WOLFSSL_AESNI +/* Every 64-bit single-precision backend works in 128-bit intermediates. An + * autoconf build learns the type is available from a configure probe; with + * user settings nobody sets HAVE___UINT128_T, and sp_int.c then fails on an + * undeclared sp_int_word. */ +#if defined(__SIZEOF_INT128__) && !defined(HAVE___UINT128_T) + #define HAVE___UINT128_T 1 +#endif #endif