Skip to content

Commit ef71b09

Browse files
torben-hansentorben-hansen
authored
Remove special s2n-bignum source code processing at buid-time (#2385)
Because of awslabs/s2n-bignum#213, we can now simplify part of the build that handles s2n-bignum integration. This PR removes the special pre-processing of s2n-bignum source code e.g. removal of ; as new-line delimiter. Instead, handle any special s2n-bignum build logic in the existing build logic e.g. specify header file location and compile-time definitions. This also means we no longer need to copy the s2n-bignum source code anywhere.
1 parent 4720791 commit ef71b09

File tree

3 files changed

+112
-133
lines changed

3 files changed

+112
-133
lines changed

‎crypto/fipsmodule/CMakeLists.txt

+100-131
Original file line numberDiff line numberDiff line change
@@ -186,153 +186,121 @@ if (CLANG AND (CMAKE_ASM_COMPILER_ID MATCHES "Clang" OR CMAKE_ASM_COMPILER MATCH
186186
set_source_files_properties(${CMAKE_CURRENT_BINARY_DIR}/rsaz-4k-avx512.${ASM_EXT} PROPERTIES COMPILE_FLAGS "-mavx512f -mavx512bw -mavx512dq -mavx512vl -mavx512ifma")
187187
endif()
188188

189-
# s2n-bignum files can be compiled on Unix platforms only (except Apple),
190-
# and on x86_64 and aarch64 systems only.
189+
# s2n-bignum files can be compiled on Unix platforms for x86_64 and arm64 only.
191190
if((((ARCH STREQUAL "x86_64") AND NOT MY_ASSEMBLER_IS_TOO_OLD_FOR_512AVX) OR
192191
ARCH STREQUAL "aarch64") AND UNIX)
193192

194193
# Set the source directory for s2n-bignum assembly files
195194
if(ARCH STREQUAL "x86_64")
196-
set(S2N_BIGNUM_DIR ${AWSLC_SOURCE_DIR}/third_party/s2n-bignum/s2n-bignum-imported/x86_att)
195+
set(S2N_BIGNUM_DIR "${AWSLC_SOURCE_DIR}/third_party/s2n-bignum/s2n-bignum-imported/x86_att")
197196
else()
198-
set(S2N_BIGNUM_DIR ${AWSLC_SOURCE_DIR}/third_party/s2n-bignum/s2n-bignum-imported/arm)
197+
set(S2N_BIGNUM_DIR "${AWSLC_SOURCE_DIR}/third_party/s2n-bignum/s2n-bignum-imported/arm")
199198
endif()
200199

201-
set(S2N_BIGNUM_INCLUDE_DIR ${AWSLC_SOURCE_DIR}/third_party/s2n-bignum/s2n-bignum-imported/include)
202-
203-
# We add s2n-bignum files to a separate list because they need
204-
# to go through C preprocessor in case of the static build.
205-
set(
206-
S2N_BIGNUM_ASM_SOURCES
207-
208-
p256/p256_montjscalarmul.S
209-
p256/p256_montjscalarmul_alt.S
210-
p256/bignum_montinv_p256.S
211-
212-
p384/bignum_add_p384.S
213-
p384/bignum_sub_p384.S
214-
p384/bignum_neg_p384.S
215-
p384/bignum_tomont_p384.S
216-
p384/bignum_deamont_p384.S
217-
p384/bignum_montmul_p384.S
218-
p384/bignum_montmul_p384_alt.S
219-
p384/bignum_montsqr_p384.S
220-
p384/bignum_montsqr_p384_alt.S
221-
p384/bignum_nonzero_6.S
222-
p384/bignum_littleendian_6.S
223-
p384/p384_montjdouble.S
224-
p384/p384_montjdouble_alt.S
225-
p384/p384_montjscalarmul.S
226-
p384/p384_montjscalarmul_alt.S
227-
p384/bignum_montinv_p384.S
228-
229-
p521/bignum_add_p521.S
230-
p521/bignum_sub_p521.S
231-
p521/bignum_neg_p521.S
232-
p521/bignum_mul_p521.S
233-
p521/bignum_mul_p521_alt.S
234-
p521/bignum_sqr_p521.S
235-
p521/bignum_sqr_p521_alt.S
236-
p521/bignum_tolebytes_p521.S
237-
p521/bignum_fromlebytes_p521.S
238-
p521/p521_jdouble.S
239-
p521/p521_jdouble_alt.S
240-
p521/p521_jscalarmul.S
241-
p521/p521_jscalarmul_alt.S
242-
p521/bignum_inv_p521.S
243-
244-
curve25519/bignum_mod_n25519.S
245-
curve25519/bignum_neg_p25519.S
246-
curve25519/bignum_madd_n25519.S
247-
curve25519/bignum_madd_n25519_alt.S
248-
curve25519/edwards25519_decode.S
249-
curve25519/edwards25519_decode_alt.S
250-
curve25519/edwards25519_encode.S
251-
curve25519/edwards25519_scalarmulbase.S
252-
curve25519/edwards25519_scalarmulbase_alt.S
253-
curve25519/edwards25519_scalarmuldouble.S
254-
curve25519/edwards25519_scalarmuldouble_alt.S
200+
set(S2N_BIGNUM_INCLUDE_DIR "${AWSLC_SOURCE_DIR}/third_party/s2n-bignum/s2n-bignum-imported/include")
201+
202+
list(APPEND BCM_ASM_SOURCES
203+
204+
${S2N_BIGNUM_DIR}/p256/p256_montjscalarmul.S
205+
${S2N_BIGNUM_DIR}/p256/p256_montjscalarmul_alt.S
206+
${S2N_BIGNUM_DIR}/p256/bignum_montinv_p256.S
207+
208+
${S2N_BIGNUM_DIR}/p384/bignum_add_p384.S
209+
${S2N_BIGNUM_DIR}/p384/bignum_sub_p384.S
210+
${S2N_BIGNUM_DIR}/p384/bignum_neg_p384.S
211+
${S2N_BIGNUM_DIR}/p384/bignum_tomont_p384.S
212+
${S2N_BIGNUM_DIR}/p384/bignum_deamont_p384.S
213+
${S2N_BIGNUM_DIR}/p384/bignum_montmul_p384.S
214+
${S2N_BIGNUM_DIR}/p384/bignum_montmul_p384_alt.S
215+
${S2N_BIGNUM_DIR}/p384/bignum_montsqr_p384.S
216+
${S2N_BIGNUM_DIR}/p384/bignum_montsqr_p384_alt.S
217+
${S2N_BIGNUM_DIR}/p384/bignum_nonzero_6.S
218+
${S2N_BIGNUM_DIR}/p384/bignum_littleendian_6.S
219+
${S2N_BIGNUM_DIR}/p384/p384_montjdouble.S
220+
${S2N_BIGNUM_DIR}/p384/p384_montjdouble_alt.S
221+
${S2N_BIGNUM_DIR}/p384/p384_montjscalarmul.S
222+
${S2N_BIGNUM_DIR}/p384/p384_montjscalarmul_alt.S
223+
${S2N_BIGNUM_DIR}/p384/bignum_montinv_p384.S
224+
225+
${S2N_BIGNUM_DIR}/p521/bignum_add_p521.S
226+
${S2N_BIGNUM_DIR}/p521/bignum_sub_p521.S
227+
${S2N_BIGNUM_DIR}/p521/bignum_neg_p521.S
228+
${S2N_BIGNUM_DIR}/p521/bignum_mul_p521.S
229+
${S2N_BIGNUM_DIR}/p521/bignum_mul_p521_alt.S
230+
${S2N_BIGNUM_DIR}/p521/bignum_sqr_p521.S
231+
${S2N_BIGNUM_DIR}/p521/bignum_sqr_p521_alt.S
232+
${S2N_BIGNUM_DIR}/p521/bignum_tolebytes_p521.S
233+
${S2N_BIGNUM_DIR}/p521/bignum_fromlebytes_p521.S
234+
${S2N_BIGNUM_DIR}/p521/p521_jdouble.S
235+
${S2N_BIGNUM_DIR}/p521/p521_jdouble_alt.S
236+
${S2N_BIGNUM_DIR}/p521/p521_jscalarmul.S
237+
${S2N_BIGNUM_DIR}/p521/p521_jscalarmul_alt.S
238+
${S2N_BIGNUM_DIR}/p521/bignum_inv_p521.S
239+
240+
${S2N_BIGNUM_DIR}/curve25519/bignum_mod_n25519.S
241+
${S2N_BIGNUM_DIR}/curve25519/bignum_neg_p25519.S
242+
${S2N_BIGNUM_DIR}/curve25519/bignum_madd_n25519.S
243+
${S2N_BIGNUM_DIR}/curve25519/bignum_madd_n25519_alt.S
244+
${S2N_BIGNUM_DIR}/curve25519/edwards25519_decode.S
245+
${S2N_BIGNUM_DIR}/curve25519/edwards25519_decode_alt.S
246+
${S2N_BIGNUM_DIR}/curve25519/edwards25519_encode.S
247+
${S2N_BIGNUM_DIR}/curve25519/edwards25519_scalarmulbase.S
248+
${S2N_BIGNUM_DIR}/curve25519/edwards25519_scalarmulbase_alt.S
249+
${S2N_BIGNUM_DIR}/curve25519/edwards25519_scalarmuldouble.S
250+
${S2N_BIGNUM_DIR}/curve25519/edwards25519_scalarmuldouble_alt.S
255251
)
256252

257253
if(ARCH STREQUAL "x86_64")
258254
# The files below contain the alternative functions for x86_64.
259255
# For AArch64, the alternative tomont/deamont functions are
260256
# the same as the non-alternative ones, so they are defined
261257
# in the corresponding "non-alt" files (bignum_<deamont|tomont>_p384.S)
262-
list(APPEND S2N_BIGNUM_ASM_SOURCES
263-
p384/bignum_tomont_p384_alt.S
264-
p384/bignum_deamont_p384_alt.S
265-
curve25519/curve25519_x25519.S
266-
curve25519/curve25519_x25519_alt.S
267-
curve25519/curve25519_x25519base.S
268-
curve25519/curve25519_x25519base_alt.S
258+
list(APPEND BCM_ASM_SOURCES
259+
${S2N_BIGNUM_DIR}/p384/bignum_tomont_p384_alt.S
260+
${S2N_BIGNUM_DIR}/p384/bignum_deamont_p384_alt.S
261+
${S2N_BIGNUM_DIR}/curve25519/curve25519_x25519.S
262+
${S2N_BIGNUM_DIR}/curve25519/curve25519_x25519_alt.S
263+
${S2N_BIGNUM_DIR}/curve25519/curve25519_x25519base.S
264+
${S2N_BIGNUM_DIR}/curve25519/curve25519_x25519base_alt.S
269265
)
270266
elseif(ARCH STREQUAL "aarch64")
271267
# byte-level interface for aarch64 s2n-bignum x25519 are in
272268
# files with "byte" tags, but ed25519 is not, neither are they byte-level...
273-
list(APPEND S2N_BIGNUM_ASM_SOURCES
274-
curve25519/curve25519_x25519_byte.S
275-
curve25519/curve25519_x25519_byte_alt.S
276-
curve25519/curve25519_x25519base_byte.S
277-
curve25519/curve25519_x25519base_byte_alt.S
269+
list(APPEND BCM_ASM_SOURCES
270+
${S2N_BIGNUM_DIR}/curve25519/curve25519_x25519_byte.S
271+
${S2N_BIGNUM_DIR}/curve25519/curve25519_x25519_byte_alt.S
272+
${S2N_BIGNUM_DIR}/curve25519/curve25519_x25519base_byte.S
273+
${S2N_BIGNUM_DIR}/curve25519/curve25519_x25519base_byte_alt.S
278274
)
279275

280276
# Big integer arithmetics using s2n-bignum
281-
list(APPEND S2N_BIGNUM_ASM_SOURCES
282-
fastmul/bignum_kmul_16_32.S
283-
fastmul/bignum_kmul_32_64.S
284-
fastmul/bignum_ksqr_16_32.S
285-
fastmul/bignum_ksqr_32_64.S
286-
fastmul/bignum_emontredc_8n.S
287-
288-
generic/bignum_ge.S
289-
generic/bignum_mul.S
290-
generic/bignum_optsub.S
291-
generic/bignum_sqr.S
292-
293-
generic/bignum_copy_row_from_table.S
294-
generic/bignum_copy_row_from_table_8n.S
295-
generic/bignum_copy_row_from_table_16.S
296-
generic/bignum_copy_row_from_table_32.S
277+
list(APPEND BCM_ASM_SOURCES
278+
${S2N_BIGNUM_DIR}/fastmul/bignum_kmul_16_32.S
279+
${S2N_BIGNUM_DIR}/fastmul/bignum_kmul_32_64.S
280+
${S2N_BIGNUM_DIR}/fastmul/bignum_ksqr_16_32.S
281+
${S2N_BIGNUM_DIR}/fastmul/bignum_ksqr_32_64.S
282+
${S2N_BIGNUM_DIR}/fastmul/bignum_emontredc_8n.S
283+
284+
${S2N_BIGNUM_DIR}/generic/bignum_ge.S
285+
${S2N_BIGNUM_DIR}/generic/bignum_mul.S
286+
${S2N_BIGNUM_DIR}/generic/bignum_optsub.S
287+
${S2N_BIGNUM_DIR}/generic/bignum_sqr.S
288+
289+
${S2N_BIGNUM_DIR}/generic/bignum_copy_row_from_table.S
290+
${S2N_BIGNUM_DIR}/generic/bignum_copy_row_from_table_8n.S
291+
${S2N_BIGNUM_DIR}/generic/bignum_copy_row_from_table_16.S
292+
${S2N_BIGNUM_DIR}/generic/bignum_copy_row_from_table_32.S
297293
)
298294
endif()
299-
endif()
300-
301-
function(s2n_asm_cpreprocess dest src)
302-
# s2n_asm_cpreprocess differs from cpreprocess in that is does additional post-processing
303-
# based on s2n-bignum https://github.com/awslabs/s2n-bignum/blob/main/x86/Makefile#L264
304-
get_filename_component(dir ${dest} DIRECTORY)
305-
if (dir STREQUAL "")
306-
set(dir ".")
307-
endif()
308-
309-
set(TARGET "")
310-
if(CMAKE_ASM_COMPILER_TARGET)
311-
set(TARGET "--target=${CMAKE_ASM_COMPILER_TARGET}")
312-
endif()
313-
314-
string(REGEX REPLACE "[ ]+" ";" CMAKE_ASM_FLAGS "${CMAKE_ASM_FLAGS}")
315295

316296
if(BORINGSSL_PREFIX)
317-
set(S2N_BIGNUM_PREFIX_INCLUDE "--include=${AWSLC_BINARY_DIR}/symbol_prefix_include/openssl/boringssl_prefix_symbols_asm.h")
297+
# s2n-bignum is third-party code and therefore doesn't have an explicit
298+
# definition of symbol prefixes under the prefix build. Inject prefix
299+
# definitions instead. One could set this property for just the s2n-bignum
300+
# source. But for simplicity, do it for all. The pre-processor will remove
301+
# any duplicate header files.
302+
set_source_files_properties(${BCM_ASM_SOURCES} PROPERTIES COMPILE_FLAGS "--include=${AWSLC_BINARY_DIR}/symbol_prefix_include/openssl/boringssl_prefix_symbols_asm.h")
318303
endif()
319-
320-
add_custom_command(
321-
OUTPUT ${dest}
322-
COMMAND ${CMAKE_COMMAND} -E make_directory ${dir}
323-
COMMAND ${CMAKE_ASM_COMPILER} ${TARGET} ${CMAKE_ASM_FLAGS} -E ${S2N_BIGNUM_DIR}/${src} -I${AWSLC_BINARY_DIR}/symbol_prefix_include -I${S2N_BIGNUM_INCLUDE_DIR} ${S2N_BIGNUM_PREFIX_INCLUDE} -DS2N_BN_HIDE_SYMBOLS | tr \"\;\" \"\\n\" > ${dest}
324-
DEPENDS
325-
${S2N_BIGNUM_DIR}/${src}
326-
WORKING_DIRECTORY .
327-
)
328-
endfunction()
329-
330-
if(S2N_BIGNUM_ASM_SOURCES)
331-
# s2n-bignum assembly files need to be processed before use
332-
foreach(asm ${S2N_BIGNUM_ASM_SOURCES})
333-
s2n_asm_cpreprocess(${asm}.S ${asm})
334-
list(APPEND BCM_ASM_SOURCES "${asm}.S")
335-
endforeach()
336304
endif()
337305

338306
if(FIPS_DELOCATE)
@@ -354,12 +322,12 @@ if(FIPS_DELOCATE)
354322

355323
bcm.c
356324
)
357-
target_compile_definitions(bcm_c_generated_asm PRIVATE BORINGSSL_IMPLEMENTATION)
325+
target_compile_definitions(bcm_c_generated_asm PRIVATE BORINGSSL_IMPLEMENTATION S2N_BN_HIDE_SYMBOLS)
358326

359327
add_dependencies(bcm_c_generated_asm boringssl_prefix_symbols)
360328
# Important: We do not want to add the generated prefix symbols to the include path here!
361329
# Delocator expects symbols to not be prefixed.
362-
target_include_directories(bcm_c_generated_asm PRIVATE ${AWSLC_SOURCE_DIR}/include)
330+
target_include_directories(bcm_c_generated_asm PRIVATE ${AWSLC_SOURCE_DIR}/include "${S2N_BIGNUM_INCLUDE_DIR}")
363331
set_target_properties(bcm_c_generated_asm PROPERTIES COMPILE_OPTIONS "-S")
364332
set_target_properties(bcm_c_generated_asm PROPERTIES POSITION_INDEPENDENT_CODE ON)
365333

@@ -384,7 +352,8 @@ if(FIPS_DELOCATE)
384352
-a $<TARGET_FILE:bcm_c_generated_asm>
385353
-o bcm-delocated.S
386354
-cc ${CMAKE_ASM_COMPILER}
387-
-cc-flags "${TARGET} ${CMAKE_ASM_FLAGS}"
355+
-cc-flags "${TARGET} ${CMAKE_ASM_FLAGS} -DS2N_BN_HIDE_SYMBOLS"
356+
-s2n-bignum-include "${S2N_BIGNUM_INCLUDE_DIR}"
388357
${DELOCATE_EXTRA_ARGS}
389358
${AWSLC_SOURCE_DIR}/include/openssl/arm_arch.h
390359
${AWSLC_SOURCE_DIR}/include/openssl/asm_base.h
@@ -415,11 +384,11 @@ if(FIPS_DELOCATE)
415384

416385
bcm-delocated.S
417386
)
418-
target_compile_definitions(bcm_hashunset PRIVATE BORINGSSL_IMPLEMENTATION)
387+
target_compile_definitions(bcm_hashunset PRIVATE BORINGSSL_IMPLEMENTATION S2N_BN_HIDE_SYMBOLS)
419388

420389
add_dependencies(bcm_hashunset boringssl_prefix_symbols)
421390
target_include_directories(bcm_hashunset BEFORE PRIVATE ${AWSLC_BINARY_DIR}/symbol_prefix_include)
422-
target_include_directories(bcm_hashunset PRIVATE ${AWSLC_SOURCE_DIR}/include)
391+
target_include_directories(bcm_hashunset PRIVATE ${AWSLC_SOURCE_DIR}/include "${S2N_BIGNUM_INCLUDE_DIR}")
423392

424393
set_target_properties(bcm_hashunset PROPERTIES POSITION_INDEPENDENT_CODE ON)
425394
set_target_properties(bcm_hashunset PROPERTIES LINKER_LANGUAGE C)
@@ -467,11 +436,11 @@ elseif(FIPS_SHARED)
467436
fips_shared_support.c
468437
cpucap/cpucap.c
469438
)
470-
target_compile_definitions(fipsmodule PRIVATE BORINGSSL_IMPLEMENTATION)
439+
target_compile_definitions(fipsmodule PRIVATE BORINGSSL_IMPLEMENTATION S2N_BN_HIDE_SYMBOLS)
471440

472441
add_dependencies(fipsmodule boringssl_prefix_symbols)
473442
target_include_directories(fipsmodule BEFORE PRIVATE ${AWSLC_BINARY_DIR}/symbol_prefix_include)
474-
target_include_directories(fipsmodule PRIVATE ${AWSLC_SOURCE_DIR}/include)
443+
target_include_directories(fipsmodule PRIVATE ${AWSLC_SOURCE_DIR}/include "${S2N_BIGNUM_INCLUDE_DIR}")
475444

476445
add_library(
477446
bcm_library
@@ -482,8 +451,8 @@ elseif(FIPS_SHARED)
482451

483452
${BCM_ASM_SOURCES}
484453
)
485-
target_compile_definitions(bcm_library PRIVATE BORINGSSL_IMPLEMENTATION)
486-
target_include_directories(bcm_library PRIVATE ${AWSLC_SOURCE_DIR}/include)
454+
target_compile_definitions(bcm_library PRIVATE BORINGSSL_IMPLEMENTATION S2N_BN_HIDE_SYMBOLS )
455+
target_include_directories(bcm_library PRIVATE ${AWSLC_SOURCE_DIR}/include "${S2N_BIGNUM_INCLUDE_DIR}")
487456

488457
add_dependencies(bcm_library boringssl_prefix_symbols)
489458
target_include_directories(bcm_library BEFORE PRIVATE ${AWSLC_BINARY_DIR}/symbol_prefix_include)
@@ -591,10 +560,10 @@ else()
591560
${BCM_ASM_SOURCES}
592561
${BCM_ASM_OBJECTS}
593562
)
594-
target_compile_definitions(fipsmodule PRIVATE BORINGSSL_IMPLEMENTATION)
563+
target_compile_definitions(fipsmodule PRIVATE BORINGSSL_IMPLEMENTATION S2N_BN_HIDE_SYMBOLS)
595564

596565
add_dependencies(fipsmodule boringssl_prefix_symbols)
597566
target_include_directories(fipsmodule BEFORE PRIVATE ${AWSLC_BINARY_DIR}/symbol_prefix_include)
598-
target_include_directories(fipsmodule PRIVATE ${AWSLC_SOURCE_DIR}/include)
567+
target_include_directories(fipsmodule PRIVATE ${AWSLC_SOURCE_DIR}/include "${S2N_BIGNUM_INCLUDE_DIR}")
599568

600569
endif()

‎include/openssl/asm_base.h

+7-2
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,13 @@
5959
// all assembly entry points because it is easier, and allows BoringSSL's ABI
6060
// tester to call the assembly entry points via an indirect jump.
6161
#include <cet.h>
62-
#else
63-
#define _CET_ENDBR
62+
#elif !defined(_CET_ENDBR)
63+
// If cet.h does not exist, manually define _CET_ENDBR to be the ENDBR64
64+
// instruction, with an explicit byte sequence for compilers/assemblers that
65+
// don't know about it. Note that it is safe to use ENDBR64 on all platforms,
66+
// since the encoding is by design interpreted as a NOP on all pre-CET x86_64
67+
// processors.
68+
#define _CET_ENDBR .byte 0xf3,0x0f,0x1e,0xfa
6469
#endif
6570

6671
#if defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64)

‎util/fipstools/delocate/delocate.go

+5
Original file line numberDiff line numberDiff line change
@@ -2275,6 +2275,7 @@ func main() {
22752275
outFile := flag.String("o", "", "Path to output assembly")
22762276
ccPath := flag.String("cc", "", "Path to the C compiler for preprocessing inputs")
22772277
ccFlags := flag.String("cc-flags", "", "Flags for the C compiler when preprocessing")
2278+
s2nBignumInclude := flag.String("s2n-bignum-include", "", "Directory with s2n-bignum header files used by the C compiler when preprocessing")
22782279
noStartEndDebugDirectives := flag.Bool("no-se-debug-directives", false, "Disables .file/.loc directives on boundary start and end symbols")
22792280

22802281
flag.Parse()
@@ -2320,6 +2321,10 @@ func main() {
23202321
})
23212322
}
23222323

2324+
if len(*s2nBignumInclude) > 0 {
2325+
includePaths[*s2nBignumInclude] = struct{}{}
2326+
}
2327+
23232328
var cppCommand []string
23242329
if len(*ccPath) > 0 {
23252330
cppCommand = append(cppCommand, *ccPath)

0 commit comments

Comments
 (0)