First draft of rust-psa-crypto, Rust wrapper for (some of) mbed-crypto.

Currently this depends on an old version of mbed-crypto.
These files are adapted from Parsec:

build-conf.toml, build.rs, setup_mbed_crypto.sh

Signed-off-by: Edmund Grimley Evans <edmund.grimley-evans@arm.com>

Cargo.toml

@@ -1,7 +1,8 @@
 [package]
 name = "psa-crypto"
 version = "0.1.0"
-authors = ["Paul Howard <paul.howard@arm.com>",
+authors = ["Edmund Grimley Evans <edmund.grimley-evans@arm.com>",
+ "Paul Howard <paul.howard@arm.com>",
  "Ionut Mihalcea <ionut.mihalcea@arm.com>",
  "Hugues de Valon <hugues.devalon@arm.com>"]
 edition = "2018"
@@ -13,3 +14,13 @@ license = "Apache-2.0"
 repository = "https://github.com/parallaxsecond/rust-psa-crypto"
 
 [dependencies]
+lazy_static = "1.4.0"
+
+[build-dependencies]
+bindgen = "0.50.0"
+cargo_toml = "0.7.0"
+serde = { version = "1.0", features = ["derive"] }
+toml = "0.4.2"
+
+[package.metadata.config]
+mbed-crypto-version = "mbedcrypto-2.0.0"

build-conf.toml

@@ -0,0 +1,19 @@
+# Configuration values for setting up and building the Mbed Crypto library that
+# psa-crypto currently depends on
+[mbed_config]
+ # Path (either relative or absolute) where the Mbed Crypto source code will be
+ # persisted.
+ # This value default to the OUT_DIR environment variable.
+ mbed_path = "/tmp/"
+
+ # When compiling natively
+ [mbed_config.native]
+ # The compiler to use when building the Mbed Crypto library
+ # mbed_compiler = "clang"
+ # The archiver to use when building the Mbed Crypto library
+ # mbed_archiver = "ar"
+
+ # When cross-compiling for aarch64-unknown-linux-gnu target
+ [mbed_config.aarch64_unknown_linux_gnu]
+ # mbed_compiler = "aarch64-linux-gnu-gcc"
+ # mbed_archiver = "aarch64-linux-gnu-ar"

build.rs

@@ -0,0 +1,277 @@
+// Copyright 2020 Contributors to the Parsec project.
+// SPDX-License-Identifier: Apache-2.0
+
+#![deny(
+ nonstandard_style,
+ const_err,
+ dead_code,
+ improper_ctypes,
+ non_shorthand_field_patterns,
+ no_mangle_generic_items,
+ overflowing_literals,
+ path_statements,
+ patterns_in_fns_without_body,
+ private_in_public,
+ unconditional_recursion,
+ unused,
+ unused_allocation,
+ unused_comparisons,
+ unused_parens,
+ while_true,
+ missing_debug_implementations,
+ trivial_casts,
+ trivial_numeric_casts,
+ unused_extern_crates,
+ unused_import_braces,
+ unused_qualifications,
+ unused_results,
+ missing_copy_implementations
+)]
+// This one is hard to avoid.
+#![allow(clippy::multiple_crate_versions)]
+
+use cargo_toml::{Manifest, Value};
+use serde::Deserialize;
+use std::env;
+use std::io::{Error, ErrorKind, Result};
+use std::path::{Path, PathBuf};
+
+const CONFIG_TABLE_NAME: &str = "config";
+const MBED_CRYPTO_VERSION_KEY: &str = "mbed-crypto-version";
+
+const SETUP_MBED_SCRIPT_PATH: &str = "./setup_mbed_crypto.sh";
+const BUILD_CONFIG_FILE_PATH: &str = "./build-conf.toml";
+
+const DEFAULT_NATIVE_MBED_COMPILER: &str = "clang";
+const DEFAULT_NATIVE_MBED_ARCHIVER: &str = "ar";
+const DEFAULT_ARM64_MBED_COMPILER: &str = "aarch64-linux-gnu-gcc";
+const DEFAULT_ARM64_MBED_ARCHIVER: &str = "aarch64-linux-gnu-ar";
+
+#[derive(Debug, Deserialize)]
+struct Configuration {
+ mbed_config: Option<MbedConfig>,
+}
+
+#[derive(Debug, Deserialize)]
+struct MbedConfig {
+ mbed_path: Option<String>,
+ native: Option<Toolchain>,
+ aarch64_unknown_linux_gnu: Option<Toolchain>,
+}
+
+#[derive(Debug, Deserialize)]
+struct Toolchain {
+ mbed_compiler: Option<String>,
+ mbed_archiver: Option<String>,
+}
+
+fn get_configuration_string(parsec_config: &Value, key: &str) -> Result<String> {
+ let config_value = get_value_from_table(parsec_config, key)?;
+ match config_value {
+ Value::String(string) => Ok(string.clone()),
+ _ => Err(Error::new(
+ ErrorKind::InvalidInput,
+ "Configuration key missing",
+ )),
+ }
+}
+
+fn get_value_from_table<'a>(table: &'a Value, key: &str) -> Result<&'a Value> {
+ match table {
+ Value::Table(table) => table.get(key).ok_or_else(|| {
+ println!("Config table does not contain configuration key: {}", key);
+ Error::new(ErrorKind::InvalidInput, "Configuration key missing.")
+ }),
+ _ => Err(Error::new(
+ ErrorKind::InvalidInput,
+ "Value provided is not a TOML table",
+ )),
+ }
+}
+
+// Get the Mbed Crypto version to branch on from Cargo.toml file. Use that and MbedConfig to pass
+// parameters to the setup_mbed_crypto.sh script which clones and builds Mbed Crypto and create
+// a static library.
+fn setup_mbed_crypto(mbed_config: &MbedConfig, mbed_version: &str) -> Result<()> {
+ let (mbed_compiler, mbed_archiver) =
+ if std::env::var("TARGET").unwrap() == "aarch64-unknown-linux-gnu" {
+ let toolchain;
+ toolchain = mbed_config
+ .aarch64_unknown_linux_gnu
+ .as_ref()
+ .ok_or_else(|| {
+ Error::new(
+ ErrorKind::InvalidInput,
+ "The aarch64_unknown_linux_gnu subtable of mbed_config should exist",
+ )
+ })?;
+ (
+ toolchain
+ .mbed_compiler
+ .clone()
+ .unwrap_or_else(|| DEFAULT_ARM64_MBED_COMPILER.to_string()),
+ toolchain
+ .mbed_archiver
+ .clone()
+ .unwrap_or_else(|| DEFAULT_ARM64_MBED_ARCHIVER.to_string()),
+ )
+ } else {
+ let toolchain;
+ toolchain = mbed_config.native.as_ref().ok_or_else(|| {
+ Error::new(
+ ErrorKind::InvalidInput,
+ "The native subtable of mbed_config should exist",
+ )
+ })?;
+ (
+ toolchain
+ .mbed_compiler
+ .clone()
+ .unwrap_or_else(|| DEFAULT_NATIVE_MBED_COMPILER.to_string()),
+ toolchain
+ .mbed_archiver
+ .clone()
+ .unwrap_or_else(|| DEFAULT_NATIVE_MBED_ARCHIVER.to_string()),
+ )
+ };
+
+ let script_fail = |_| {
+ Err(Error::new(
+ ErrorKind::Other,
+ "setup_mbed_crypto.sh script failed",
+ ))
+ };
+
+ println!("cargo:rerun-if-changed={}", SETUP_MBED_SCRIPT_PATH);
+ println!("cargo:rerun-if-changed={}", "src/c/Makefile");
+ println!("cargo:rerun-if-changed={}", "src/c/shim.c");
+ println!("cargo:rerun-if-changed={}", "src/c/shim.h");
+
+ if !::std::process::Command::new(SETUP_MBED_SCRIPT_PATH)
+ .arg(mbed_version)
+ .arg(
+ mbed_config
+ .mbed_path
+ .clone()
+ .unwrap_or_else(|| env::var("OUT_DIR").unwrap()),
+ )
+ .arg(format!("CC={}", mbed_compiler))
+ .arg(format!("AR={}", mbed_archiver))
+ .status()
+ .or_else(script_fail)?
+ .success()
+ {
+ Err(Error::new(
+ ErrorKind::Other,
+ "setup_mbed_crypto.sh returned an error status.",
+ ))
+ } else {
+ Ok(())
+ }
+}
+
+fn generate_mbed_bindings(mbed_config: &MbedConfig, mbed_version: &str) -> Result<()> {
+ let mbed_include_dir = mbed_config
+ .mbed_path
+ .clone()
+ .unwrap_or_else(|| env::var("OUT_DIR").unwrap())
+ + "/mbed-crypto-"
+ + mbed_version
+ + "/include";
+ let header = mbed_include_dir.clone() + "/psa/crypto.h";
+
+ println!("cargo:rerun-if-changed={}", header);
+
+ let shim_bindings = bindgen::Builder::default()
+ .clang_arg(format!("-I{}", mbed_include_dir))
+ .rustfmt_bindings(true)
+ .header("src/c/shim.h")
+ .generate_comments(false)
+ .generate()
+ .or_else(|_| {
+ Err(Error::new(
+ ErrorKind::Other,
+ "Unable to generate bindings to mbed crypto",
+ ))
+ })?;
+ let out_path = PathBuf::from(env::var("OUT_DIR").unwrap());
+ shim_bindings.write_to_file(out_path.join("shim_bindings.rs"))
+}
+
+// Get the compiler, the archiver and the location where to clone the Mbed Crypto repository.
+fn parse_config_file() -> Result<Configuration> {
+ let config_str = ::std::fs::read_to_string(Path::new(BUILD_CONFIG_FILE_PATH))?;
+ Ok(toml::from_str(&config_str).or_else(|e| {
+ println!("Error parsing build configuration file ({}).", e);
+ Err(Error::new(
+ ErrorKind::InvalidInput,
+ "Could not parse build configuration file.",
+ ))
+ })?)
+}
+
+fn main() -> Result<()> {
+ // Parsing build-conf.toml
+ let config = parse_config_file()?;
+
+ // Parsing Cargo.toml
+ let toml_path = std::path::Path::new("./Cargo.toml");
+ if !toml_path.exists() {
+ return Err(Error::new(
+ ErrorKind::InvalidInput,
+ "Could not find Cargo.toml.",
+ ));
+ }
+ let manifest = Manifest::from_path(&toml_path).or_else(|e| {
+ println!("Error parsing Cargo.toml ({}).", e);
+ Err(Error::new(
+ ErrorKind::InvalidInput,
+ "Could not parse Cargo.toml.",
+ ))
+ })?;
+
+ let package = manifest.package.ok_or_else(|| {
+ Error::new(
+ ErrorKind::InvalidInput,
+ "Cargo.toml does not contain package information.",
+ )
+ })?;
+ let metadata = package.metadata.ok_or_else(|| {
+ Error::new(
+ ErrorKind::InvalidInput,
+ "Cargo.toml does not contain package metadata.",
+ )
+ })?;
+ let parsec_config = get_value_from_table(&metadata, CONFIG_TABLE_NAME)?;
+
+ if true {
+ let mbed_config = config.mbed_config.ok_or_else(|| {
+ Error::new(
+ ErrorKind::InvalidInput,
+ "Could not find mbed_config table in the config file.",
+ )
+ })?;
+
+ let mbed_version = get_configuration_string(&parsec_config, MBED_CRYPTO_VERSION_KEY)?;
+
+ setup_mbed_crypto(&mbed_config, &mbed_version)?;
+ generate_mbed_bindings(&mbed_config, &mbed_version)?;
+
+ // Request rustc to link the Mbed Crypto static library
+ println!(
+ "cargo:rustc-link-search=native={}/mbed-crypto-{}/library/",
+ mbed_config
+ .mbed_path
+ .unwrap_or_else(|| env::var("OUT_DIR").unwrap()),
+ mbed_version,
+ );
+ println!("cargo:rustc-link-lib=static=mbedcrypto");
+
+ // Also link shim library
+ println!("cargo:rustc-link-search=native={}",
+ env::var("OUT_DIR").unwrap());
+ println!("cargo:rustc-link-lib=static=shim");
+ }
+
+ Ok(())
+}

setup_mbed_crypto.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+
+# ------------------------------------------------------------------------------
+# Copyright 2020 Contributors to the Parsec project.
+# SPDX-License-Identifier: Apache-2.0
+# ------------------------------------------------------------------------------
+
+MBED_VERSION=$1
+if [[ -z "$MBED_VERSION" ]]; then
+ >&2 echo "No mbed version provided."
+ exit 1
+fi
+
+MBED_GITHUB_URL="https://github.com/ARMmbed/mbed-crypto"
+MBED_ROOT_FOLDER_NAME="mbed-crypto-$MBED_VERSION"
+MBED_LIB_FILENAME="libmbedcrypto.a"
+MBED_SHIMLIB_DIR="src/c"
+
+# Where to clone the Mbed Crypto library
+TEMP_FOLDER=$2
+if [[ -z "$TEMP_FOLDER" ]]; then
+ >&2 echo "No temporary folder for mbed provided."
+ exit 1
+fi
+
+# These options refer to CC and AR
+OPTIONS="$3 $4"
+
+if [[ -z "$(type git 2> /dev/null)" ]]; then
+ >&2 echo "Git not installed."
+ exit 1
+fi
+
+get_mbed_repo() {
+ echo "No mbed-crypto present locally. Cloning."
+ wget $MBED_GITHUB_URL/archive/$MBED_VERSION.tar.gz
+ tar xf $MBED_VERSION.tar.gz
+ pushd $MBED_ROOT_FOLDER_NAME
+}
+
+setup_mbed_library() {
+ echo "Building libmbedcrypto."
+ #TODO: explain the bug with SHARED, it is needed for correct linking on some Linux machine
+ make SHARED=0 $OPTIONS > /dev/null
+}
+
+# Fetch mbed-crypto source code
+mkdir -p $TEMP_FOLDER
+pushd $TEMP_FOLDER
+if [[ -d "$MBED_ROOT_FOLDER_NAME" ]]; then
+ pushd $MBED_ROOT_FOLDER_NAME
+else
+ get_mbed_repo
+fi
+
+# Set up lib
+if [[ -e "library/$MBED_LIB_FILENAME" ]]; then
+ echo "Library is set up."
+else
+ setup_mbed_library
+fi
+
+# Build shimlib
+INCLUDE="`pwd`/include"
+SRCDIR="$CARGO_MANIFEST_DIR/$MBED_SHIMLIB_DIR"
+pushd "$OUT_DIR" || exit 1
+#xx Some config may be needed here, and what about cross-compilation?
+cc -I"$INCLUDE" -Wall -Werror -O2 -c "$SRCDIR"/shim.c -o shim.o
+ar rv libshim.a shim.o