Extend the PolarFire SoC Athena port to SHA-2, AES, the RNG, ECC and RSA

Author: dgarske

.github/workflows/mpfs-athena-compile.yml

@@ -3,8 +3,8 @@ name: "Microchip PolarFire SoC Athena port"
 # Keeps the PolarFire SoC Athena F5200 crypto callback port compiling against
 # the real Microchip CAL. The port is only built when --with-mpfs-athena names a
 # CAL directory, so no other job compiles a line of it: without this guard a
-# rename in the CAL headers, or a refactor in aes.c, sha512.c or cryptocb.h,
-# would break it silently until someone next built for the board.
+# rename in the CAL headers, or a refactor in a wolfCrypt algorithm file or
+# cryptocb.h, would break it silently until someone next built for the board.
 #
 # Nothing is faked: the CAL ships in a public GitHub repository, headers and
 # archive both, so this compiles against the genuine vendor headers at a pinned
@@ -17,7 +17,7 @@ name: "Microchip PolarFire SoC Athena port"
 # by crossbuild-essential-riscv64, and a bare-metal toolchain would make this
 # job depend on how a libc happens to be packaged. None of that is what the job
 # is guarding: the breakage it catches is a CAL header rename, or a refactor in
-# aes.c, sha512.c or cryptocb.h, and the host compiler sees all of it. The
+# an algorithm file or cryptocb.h, and the host compiler sees all of it. The
 # target ABI is proven by building for the board, not here.
 #
 # Functional correctness is validated on an MPFS250TS Video Kit; see
@@ -74,13 +74,59 @@ jobs:
             extra: '-DWOLFSSL_SHA512 -DWOLFSSL_SHA384 -DWOLFSSL_AES_COUNTER'
           # The port advertises independent algorithm gates, so each has to
           # build on its own: an AES-only build has no WC_SHA384_DIGEST_SIZE,
-          # and a SHA-only build compiles no cipher path.
+          # and a SHA-only build compiles no cipher path. SHA-256 is on by
+          # default, so the AES-only legs opt out of it.
           - leg: aesctr-only
-            extra: '-DWOLFSSL_AES_COUNTER'
+            extra: '-DWOLFSSL_AES_COUNTER -DWC_MPFS_ATHENA_NO_SHA256'
           - leg: sha384-only
             extra: '-DWOLFSSL_SHA512 -DWOLFSSL_SHA384'
+          # The cipher case is shared by CTR and ECB, so each must build with
+          # the other gate off.
+          - leg: aesecb-only
+            extra: '-DHAVE_AES_ECB -DWC_MPFS_ATHENA_NO_SHA256'
+          # The XTS build the ECB path exists for, with a raised minimum so the
+          # self-test takes its larger-buffer branch.
+          - leg: aesxts
+            extra: '-DWOLFSSL_SHA512 -DWOLFSSL_SHA384 -DWOLFSSL_AES_COUNTER -DHAVE_AES_ECB -DWOLFSSL_AES_XTS -DWOLFSSL_AES_DIRECT -DWC_MPFS_ATHENA_AES_MIN_SZ=512'
           - leg: no-selftest
             extra: '-DWOLFSSL_SHA512 -DWOLFSSL_SHA384 -DWOLFSSL_AES_COUNTER -DWC_MPFS_ATHENA_NO_SELFTEST'
+          # Every SHA-2 type, with the copy and free paths that allocate.
+          - leg: sha2-all
+            extra: '-DWOLFSSL_SHA224 -DWOLFSSL_SHA512 -DWOLFSSL_SHA384 -DCI_HEAP -DWOLFSSL_SMALL_STACK -DWOLFSSL_SMALL_STACK_CACHE -DWOLFSSL_HASH_KEEP -DWOLFSSL_HASH_FLAGS'
+          # Every AES mode and CMAC, with a raised GCM minimum.
+          - leg: aes-all
+            extra: '-DHAVE_AES_CBC -DHAVE_AESGCM -DHAVE_AES_KEYWRAP -DWOLFSSL_AES_KEYWRAP_PADDING -DWOLFSSL_CMAC -DWOLFSSL_AES_DIRECT -DWOLFSSL_AES_COUNTER -DHAVE_AES_ECB -DWOLFSSL_AES_XTS -DWC_MPFS_ATHENA_GCM_MIN_SZ=64'
+          - leg: rng-drbg
+            extra: '-DWC_MPFS_ATHENA_RNG_DRBG'
+          # The wolfBoot test application's shape: its own generator, no DRBG.
+          - leg: custom-rng
+            extra: '-DWC_NO_HASHDRBG -DCUSTOM_RAND_GENERATE_BLOCK=my_rng -DWOLFSSL_SHA512 -DWOLFSSL_SHA384 -DHAVE_AES_ECB'
+          # Every RNG seeded from the engine, whatever its devId.
+          - leg: custom-seed
+            extra: '-DCUSTOM_RAND_GENERATE_SEED=wc_MpfsAthena_GenerateSeed -DWOLFSSL_SHA512 -DWOLFSSL_SHA384'
+          # Every curve, and each ECC operation on its own, since the shared
+          # helpers are gated on the ones that use them.
+          - leg: ecc-all
+            extra: '-DHAVE_ECC -DHAVE_ECC192 -DHAVE_ECC224 -DHAVE_ECC384 -DHAVE_ECC521 -DWOLFSSL_SHA512 -DWOLFSSL_SHA384'
+          - leg: ecc-verify-only
+            extra: '-DHAVE_ECC -DNO_ECC_SIGN -DNO_ECC_DHE'
+          - leg: ecc-sign-only
+            extra: '-DHAVE_ECC -DNO_ECC_VERIFY -DNO_ECC_DHE'
+          - leg: ecc-dhe-only
+            extra: '-DHAVE_ECC -DNO_ECC_SIGN -DNO_ECC_VERIFY'
+          # Without ASN.1 the signature is r || s; wolfBoot's own
+          # verify-only build is this shape.
+          - leg: ecc-no-asn
+            extra: '-DHAVE_ECC -DHAVE_ECC384 -DNO_ASN -DWOLFSSL_SHA512 -DWOLFSSL_SHA384'
+          - leg: ecc-blind-set-k
+            extra: '-DHAVE_ECC -DWOLFSSL_ECC_BLIND_K -DWOLFSSL_ECDSA_SET_K -DWOLFSSL_ECDSA_DETERMINISTIC_K'
+          - leg: rsa
+            extra: '-DCI_RSA -DCI_HEAP -DWOLFSSL_SMALL_STACK -DWOLF_CRYPTO_CB_RSA_PAD'
+          - leg: rsa-public-only
+            extra: '-DCI_RSA -DWOLFSSL_RSA_PUBLIC_ONLY -DWC_MPFS_ATHENA_RSA_PUBLIC'
+          # Every family kept in software.
+          - leg: all-opted-out
+            extra: '-DCI_RSA -DHAVE_ECC -DHAVE_AESGCM -DWOLFSSL_CMAC -DWOLFSSL_AES_DIRECT -DHAVE_AES_KEYWRAP -DWOLFSSL_SHA512 -DWOLFSSL_SHA384 -DWC_MPFS_ATHENA_NO_SHA256 -DWC_MPFS_ATHENA_NO_SHA512 -DWC_MPFS_ATHENA_NO_CBC -DWC_MPFS_ATHENA_NO_GCM -DWC_MPFS_ATHENA_NO_KEYWRAP -DWC_MPFS_ATHENA_NO_CMAC -DWC_MPFS_ATHENA_NO_RNG -DWC_MPFS_ATHENA_NO_ECC -DWC_MPFS_ATHENA_NO_RSA'
     steps:
       - uses: actions/checkout@v4
         name: Checkout wolfSSL
@@ -118,12 +164,19 @@ jobs:
           #define SINGLE_THREADED
           #define NO_FILESYSTEM
           #define NO_WOLFSSL_DIR
-          /* The first targets have no heap, so this is the static-pool leg. */
+          /* The first targets have no heap, so this is the static-pool leg
+           * unless a matrix leg asks for one. */
+          #ifndef CI_HEAP
           #define WOLFSSL_NO_MALLOC
           #define NO_WOLFSSL_MEMORY
+          #endif
           #define WC_NO_HARDEN
+          #if !defined(HAVE_ECC) && !defined(CI_RSA)
           #define NO_BIG_INT
+          #endif
+          #ifndef CI_RSA
           #define NO_RSA
+          #endif
           #define NO_DH
           #define NO_DSA
           #endif
@@ -136,6 +189,17 @@ jobs:
             wolfcrypt/src/port/microchip/mpfs_athena.c \
             -o "$GITHUB_WORKSPACE/mpfs_athena.o"
 
+          # The seed function is called from random.c, which has to see its
+          # prototype.
+          if [ "${{ matrix.leg }}" = "custom-seed" ]; then
+            cc -c \
+              -Wall -Wextra -Werror \
+              -I. -I"$GITHUB_WORKSPACE/cfg" -I"$CAL" \
+              -DWOLFSSL_USER_SETTINGS ${{ matrix.extra }} \
+              wolfcrypt/src/random.c \
+              -o "$GITHUB_WORKSPACE/random.o"
+          fi
+
       - name: Check every CAL symbol resolves in the archive
         run: |
           set -e
@@ -150,7 +214,7 @@ jobs:
           # cleanly here, so it has to be checked explicitly.
           missing=0
           for sym in $(nm --undefined-only "$OBJ" \
-                         | awk '{print $2}' | grep -E '^(CAL|aesf5200|shaf5200)'); do
+                         | awk '{print $2}' | grep -E '^(CAL|aesf5200|shaf5200|uiROMMods$)'); do
               if grep -qx "$sym" /tmp/cal_defined; then
                   echo "  ok      $sym"
               else

configure.ac

@@ -12573,13 +12573,13 @@ fi
 
 if test "x$ENABLED_MPFS_ATHENA" = "xyes"
 then
-    # The port offloads what the ordinary wolfCrypt gates turn on, so without
-    # these it would compile to nothing.
-    if test "x$ENABLED_SHA384" = "xno"; then
-        AC_MSG_ERROR([--with-mpfs-athena needs SHA-384; drop --disable-sha384])
-    fi
-    if test "x$ENABLED_AESCTR" = "xno"; then
-        AC_MSG_ERROR([--with-mpfs-athena needs AES-CTR; add --enable-aesctr])
+    # AES-XTS reaches the engine only through the bulk ECB call that
+    # HAVE_AES_ECB compiles in; without it every XTS block is its own engine
+    # transaction, slower than software.
+    if test "x$ENABLED_AESXTS" = "xyes" && test "x$ENABLED_AESECB" = "xno"; then
+        ENABLED_AESECB=yes
+        AM_CFLAGS="$AM_CFLAGS -DHAVE_AES_ECB"
+        AM_CCASFLAGS="$AM_CCASFLAGS -DHAVE_AES_ECB"
     fi
 fi
 

wolfcrypt/benchmark/benchmark.c

@@ -5342,6 +5342,12 @@ int benchmark_free(void)
         printf("%serror %d with wolfCrypt_Cleanup\n", err_prefix, ret);
     }
 
+#ifdef WOLFSSL_STATIC_MEMORY
+    /* The next benchmark_init() loads the pool again from its start, which
+     * would partition over this heap's structures if the hint were kept. */
+    HEAP_HINT = NULL;
+#endif
+
     return ret;
 }
 

wolfcrypt/src/aes.c

@@ -10010,6 +10010,9 @@ static void GMULT(byte *x, byte m[256][WC_AES_BLOCK_SIZE],
     XMEMCPY(x, Z + 1, WC_AES_BLOCK_SIZE);
 #endif
 #else
+/* The 64-bit word path reads Z at odd offsets, so it needs unaligned loads
+ * just as the 32-bit one does. */
+#ifndef WOLFSSL_USE_ALIGN
     byte* Z = ws->b;
     byte a;
     word64* pZ;
@@ -10036,6 +10039,24 @@ static void GMULT(byte *x, byte m[256][WC_AES_BLOCK_SIZE],
     pZ = (word64*)(Z + 1);
     pm = (word64*)(m[x[0]]);
     px[0] = pZ[0] ^ pm[0]; px[1] = pZ[1] ^ pm[1];
+#else
+    byte* Z = ws->b;
+    byte a;
+    int i;
+
+    XMEMCPY(Z + 16, m[x[15]], WC_AES_BLOCK_SIZE);
+    a = Z[16 + 15];
+    Z[15]  = R[a][0];
+    Z[16] ^= R[a][1];
+    for (i = 14; i > 0; i--) {
+        xorbuf(Z + i + 1, m[x[i]], WC_AES_BLOCK_SIZE);
+        a = Z[16 + i];
+        Z[i]    = R[a][0];
+        Z[i+1] ^= R[a][1];
+    }
+    xorbuf(Z + 1, m[x[0]], WC_AES_BLOCK_SIZE);
+    XMEMCPY(x, Z + 1, WC_AES_BLOCK_SIZE);
+#endif
 #endif
 }
 #endif