Initial implementation of Cypress Crypto hardware acceleration for mbedTLS #11046

kotkcy · 2019-07-14T11:13:48Z

Kind request for ARM team!!!

Could you please make a review as soon as possible - we need this for our customer. Ideally at start on the next week.

Description

This PR brings the following major updates to the Cypress PSoC 6 targets for Mbed TLS library resides in Mbed OS 5.13:

Initial implementation of the Cypress hardware acceleration target for mbedTLS (features/mbedtls/targets/TARGET_Cypress)
Updated Cypress CSP HAL to support all crypto hardware resources (targets/TARGET_Cypress/TARGET_PSOC6/psoc6csp/hal/)
Updated targets.json file to enable mbedTLS hardware acceleration for Cypress MCUs (targets/targets.json)

This PR is based on PR #11018, so actual changes only related to crypto acceleration support in MbedTLS library.

Pull request type

[ ] Fix
[ ] Refactor
[x] Target update
[ ] Functionality change
[ ] Docs update
[ ] Test update
[ ] Breaking change

Reviewers

Please suggest

Release Notes

ciarmcom · 2019-07-14T13:00:26Z

@kotkcy, thank you for your changes.
@ARMmbed/mbed-os-maintainers @ARMmbed/mbed-os-storage @ARMmbed/mbed-os-crypto @ARMmbed/mbed-os-tools please review.

SeppoTakalo

Many .py files are missing their license headers.
Please add.

Then there is Oracle Binary Code License Agreement is this needed, and why? I need to seek advice whether this can be accepted.

targets/TARGET_Cypress/TARGET_PSOC6/sb-tools/imgtool/aes_cipher.py

targets/TARGET_Cypress/TARGET_PSOC6/sb-tools/imgtool/create_aesHeader.py

targets/TARGET_Cypress/TARGET_PSOC6/sb-tools/imgtool/ecc_kdf.py

targets/TARGET_Cypress/TARGET_PSOC6/sb-tools/imgtool/imgtool/keys/ecdsa.py

targets/TARGET_Cypress/TARGET_PSOC6/sb-tools/imgtool/imgtool/keys/ecdsa_test.py

targets/TARGET_Cypress/TARGET_PSOC6/sb-tools/imgtool/imgtool/keys/general.py

targets/TARGET_Cypress/TARGET_PSOC6/sb-tools/imgtool/imgtool/keys/rsa.py

targets/TARGET_Cypress/TARGET_PSOC6/sb-tools/imgtool/imgtool/keys/rsa_test.py

bulislaw · 2019-07-16T12:42:43Z

@Patater do we even accept code into mbed TLS copy that resides in Mbed OS? I have a feeling they'll be lost during an update.

kotkcy · 2019-07-16T14:06:32Z

Many .py files are missing their license headers.
Please add.

Then there is Oracle Binary Code License Agreement is this needed, and why? I need to seek advice whether this can be accepted.

SeppoTakalo · 2019-07-17T12:07:52Z

Why is the Oracle binary license required?

kotkcy · 2019-07-19T08:34:02Z

Many .py files are missing their license headers.
Please add.
@SeppoTakalo please look into the newly uploaded files that have required licenses.

Patater · 2019-07-19T15:37:55Z

@Patater do we even accept code into mbed TLS copy that resides in Mbed OS? I have a feeling they'll be lost during an update.

We generally don't accept code into the copies of Mbed TLS or Mbed Crypto that resides in Mbed OS. Exactly as you say, the changes will be lost upon the next update of Mbed TLS and Mbed Crypto. Any changes to Mbed TLS or Mbed Crypto should be raised as PRs to https://github.com/ARMmbed/mbedtls and https://github.com/ARMmbed/mbed-crypto

SeppoTakalo

This PR now seems to contain test changes TESTS/mbed_platform/atomic/main.cpp as well as API changes Atomic.h.
And various smaller touches to AT_cellular stuff.

Those have nothing to do with "Initial implementatation of Cypress Crypto" and should therefore be separated to own PR.

vmedcy · 2019-07-26T09:28:12Z

@SeppoTakalo: the presence of unrelated changes was caused by the wrong branch used as a base of contributions (GitHub PRs always display difference against latest master).

This PR is now rebased against master + #11018 commits included. Once CY8CPROTO_064_SB target is merged, this PR will contain single commit 6a123d3.

I recommend to focus the review on this commit, and track CY8CPROTO_064_SB related issues in #11018

0xc0170 · 2019-08-09T11:56:55Z

#11018 is moving forward. Once it is in, this should be rebased. Meanwhile, can this PR be made on its own (so we can focus on reviewing just crypto implementation) ?

At least share range of commits for review here.

kotkcy

just alignment in some mbedtls files (tabs used?)

All TABs are changed to spaces in the commit 08fd157.

mark-edgeworth

Generally there are quite a few cases where some really complex C code has been used and which could be simplified to make later maintenance/bug fixing much easier. I appreciate that this stuff is complex, but using longer and more descriptive variable names might help too. Putting braces around statements within every 'if' statement is usually recommended.

features/mbedtls/targets/TARGET_Cypress/TARGET_PSOC6/TARGET_PSOC6_01/sha256_alt.h

features/mbedtls/targets/TARGET_Cypress/TARGET_PSOC6/TARGET_PSOC6_01/sha512_alt.h

features/mbedtls/targets/TARGET_Cypress/TARGET_PSOC6/TARGET_PSOC6_02/sha1_alt.h

features/mbedtls/targets/TARGET_Cypress/TARGET_PSOC6/TARGET_PSOC6_02/sha256_alt.h

features/mbedtls/targets/TARGET_Cypress/TARGET_PSOC6/TARGET_PSOC6_02/sha512_alt.h

mark-edgeworth · 2019-09-02T16:10:44Z

features/mbedtls/targets/TARGET_Cypress/TARGET_PSOC6/ecp_alt.c

+    MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &R->Z, &E,      &R->Z ) ); MOD_MUL( R->Z );
+
+cleanup:
+    mbedtls_mpi_free( &A ); mbedtls_mpi_free( &AA ); mbed


Not required as this is the next statement

Please look into ecp.c line 2281.

mark-edgeworth · 2019-09-02T16:13:43Z

features/mbedtls/targets/TARGET_Cypress/TARGET_PSOC6/ecp_curves_alt.c

+/*
+ * Domain parameters for secp192r1
+ */
+#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)


Are these numbers ok to be included here or are they hackable?

Please look into ecp_curves.c line 95.

features/mbedtls/targets/TARGET_Cypress/TARGET_PSOC6/aes_alt.c

mark-edgeworth · 2019-09-02T16:21:25Z

features/mbedtls/targets/TARGET_Cypress/TARGET_PSOC6/aes_alt.c

+#endif
+
+#ifndef PUT_UINT64_LE
+#define PUT_UINT64_LE(n,b,i)                            \


Two issues:

If any of the input parameters have a side effect then this macro will not work as intended.

What happens if 'n' is signed and negative? C standard says undefined; could be sign extended.

This code was captured to support XTS cipher mode from aes.c. Please look into line 1129.

mark-edgeworth · 2019-09-02T16:23:10Z

features/mbedtls/targets/TARGET_Cypress/TARGET_PSOC6/aes_alt.c

+
+/* Endianess with 64 bits values */
+#ifndef GET_UINT64_LE
+#define GET_UINT64_LE(n,b,i)                            \


Potential for error if any parameter has a side effect. Also might read better if 'n' was the result of the macro being used as an R-value, eg result = GET_UINT64_LE(buff, offset)

This code was captured to support XTS cipher mode from aes.c. Please look into line 1116.

mark-edgeworth · 2019-09-03T08:27:59Z

Generally it looks like lots of this code was copied from elsewhere in mbed-os, and the original code has quite a few 'clever' (aka difficult to maintain/understand) bits of C in it that are being replicated here. I have highlighted several places where improvements could be made to improve readability, and a couple of cases where incipient bugs might lurk.

Patater

I have just one remaining question about how the AES hardware sharing works with regard to XTS mode (which uses two AES contexts at the same time). The underlying driver handles multiple concurrent operations, but I did not review how that is done.

0xc0170 · 2019-09-03T11:42:28Z

CI started

mbed-ci · 2019-09-03T13:00:17Z

Test run: FAILED

Summary: 3 of 4 test jobs failed
Build number : 1
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_build-GCC_ARM
jenkins-ci/mbed-os-ci_build-ARM
jenkins-ci/mbed-os-ci_build-IAR

0xc0170 · 2019-09-03T13:00:28Z

Because of 5.14.0-rc1 CI jobs, we aborted CI job here. We will restart once 5.14.0rc1 is ready.

kotkcy · 2019-09-03T16:04:41Z

I have just one remaining question about how the AES hardware sharing works with regard to XTS mode (which uses two AES contexts at the same time). The underlying driver handles multiple concurrent operations, but I did not review how that is done.

PDL crypto driver provides a separated contexts for all AES objects that hold all needed information inside.

So we can use many AES objects at the same time at driver layer not in the hardware.

Patater · 2019-09-03T17:53:38Z

I have just one remaining question about how the AES hardware sharing works with regard to XTS mode (which uses two AES contexts at the same time). The underlying driver handles multiple concurrent operations, but I did not review how that is done.

PDL crypto driver provides a separated contexts for all AES objects that hold all needed information inside.

So we can use many AES objects at the same time at driver layer not in the hardware.

Sounds good to me. Thanks for the explanation.

0xc0170 · 2019-09-04T07:33:49Z

CI restarted

mbed-ci · 2019-09-04T08:41:29Z

Test run: FAILED

Summary: 3 of 4 test jobs failed
Build number : 2
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_build-ARM
jenkins-ci/mbed-os-ci_build-GCC_ARM
jenkins-ci/mbed-os-ci_build-IAR

0xc0170 · 2019-09-04T09:01:31Z

CI restarted

kotkcy · 2019-09-04T09:31:06Z

CI restarted

@0xc0170 I removed mbedTLS hardware support from Sequana targets, so please restart CI asap

0xc0170 · 2019-09-04T12:02:29Z

CI aborted and restarted

mbed-ci · 2019-09-04T12:32:51Z

Test run: FAILED

Summary: 3 of 4 test jobs failed
Build number : 3
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_build-ARM
jenkins-ci/mbed-os-ci_build-IAR
jenkins-ci/mbed-os-ci_build-GCC_ARM

0xc0170 · 2019-09-04T12:37:56Z

New CI is running, old one was aborted quite late.. ^^

mbed-ci · 2019-09-04T16:52:33Z

Test run: SUCCESS

Summary: 11 of 11 test jobs passed
Build number : 4
Build artifacts

kotkcy changed the title ~~Pr/cy mbedtls alt~~ Initial implementation of Cypress Crypto hardware acceleration for mbedTLS Jul 14, 2019

ciarmcom requested review from a team July 14, 2019 13:00

ciarmcom requested a review from a team July 14, 2019 13:00

ciarmcom added the needs: review label Jul 14, 2019

SeppoTakalo suggested changes Jul 15, 2019

View reviewed changes

kotkcy closed this Jul 16, 2019

kotkcy reopened this Jul 16, 2019

romanjoe added a commit to romanjoe/mbed-os that referenced this pull request Jul 16, 2019

Updated licenses in files, mentioned in commnets to ARMmbed#11046

2258b98

kotkcy force-pushed the pr/cy_mbedtls_alt branch from ed3a1b0 to e63c255 Compare July 17, 2019 15:30

SeppoTakalo added the needs: work label Jul 18, 2019

SeppoTakalo suggested changes Jul 23, 2019

View reviewed changes

SeppoTakalo removed the needs: review label Jul 25, 2019

kotkcy force-pushed the pr/cy_mbedtls_alt branch 2 times, most recently from 0f0177a to 6a123d3 Compare July 26, 2019 09:21

kotkcy pushed a commit to kotkcy/mbed-os that referenced this pull request Jul 26, 2019

Updated licenses in files, mentioned in commnets to ARMmbed#11046

0cf6675

SeppoTakalo added needs: preceding PR and removed needs: work labels Jul 29, 2019

kotkcy force-pushed the pr/cy_mbedtls_alt branch 2 times, most recently from 07f8cb9 to 1c4e2ab Compare August 8, 2019 15:07

kotkcy pushed a commit to kotkcy/mbed-os that referenced this pull request Aug 8, 2019

Updated licenses in files, mentioned in commnets to ARMmbed#11046

0310e61

Removed TABs from the ALT source files

08fd157

kotkcy commented Sep 2, 2019

View reviewed changes

hugueskamba pushed a commit to hugueskamba/mbed-os that referenced this pull request Sep 2, 2019

Updated licenses in files, mentioned in commnets to ARMmbed#11046

50d16c9

mark-edgeworth reviewed Sep 2, 2019

View reviewed changes

Changed order of config file checking in include defines

235949b

Patater approved these changes Sep 3, 2019

View reviewed changes

0xc0170 self-requested a review September 3, 2019 11:40

0xc0170 approved these changes Sep 3, 2019

View reviewed changes

0xc0170 added needs: CI and removed needs: work labels Sep 3, 2019

Removed mbedTLS hardware support from FUTURE_SEQUANA targets

d4746dd

0xc0170 added ready for merge and removed needs: CI labels Sep 5, 2019

0xc0170 merged commit f023426 into ARMmbed:master Sep 5, 2019

0xc0170 removed the ready for merge label Sep 5, 2019

kotkcy mentioned this pull request Sep 11, 2019

Updated mbedTLS CRYPTO target to be more flexibly configured for supported boards #11465

Merged

Initial implementation of Cypress Crypto hardware acceleration for mbedTLS #11046

Initial implementation of Cypress Crypto hardware acceleration for mbedTLS #11046

Uh oh!

Conversation

kotkcy commented Jul 14, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Kind request for ARM team!!!

Description

Pull request type

Reviewers

Release Notes

Uh oh!

ciarmcom commented Jul 14, 2019

Uh oh!

SeppoTakalo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bulislaw commented Jul 16, 2019

Uh oh!

kotkcy commented Jul 16, 2019

Uh oh!

SeppoTakalo commented Jul 17, 2019

Uh oh!

kotkcy commented Jul 19, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Patater commented Jul 19, 2019

Uh oh!

SeppoTakalo left a comment

Choose a reason for hiding this comment

Uh oh!

vmedcy commented Jul 26, 2019

Uh oh!

0xc0170 commented Aug 9, 2019

Uh oh!

kotkcy left a comment

Choose a reason for hiding this comment

Uh oh!

mark-edgeworth left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mark-edgeworth commented Sep 3, 2019

Uh oh!

Patater left a comment

Choose a reason for hiding this comment

Uh oh!

0xc0170 commented Sep 3, 2019

Uh oh!

mbed-ci commented Sep 3, 2019

Uh oh!

kotkcy commented Jul 14, 2019 •

edited

Loading

kotkcy commented Jul 19, 2019 •

edited

Loading