Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b

["Wang, Jian J" <jian.j.wang@intel.com>]

Ard,


> -----Original Message-----
> From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Ard
> Biesheuvel
> Sent: Friday, May 17, 2019 11:06 PM
> To: Laszlo Ersek <lersek@redhat.com>
> Cc: Wang, Jian J <jian.j.wang@intel.com>; devel@edk2.groups.io; Lu, XiaoyuX
> <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif Lindholm
> <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com>
> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b
> 
> On Fri, 17 May 2019 at 15:17, Laszlo Ersek <lersek@redhat.com> wrote:
> >
> > On 05/17/19 15:04, Laszlo Ersek wrote:
> > > On 05/17/19 07:11, Wang, Jian J wrote:
> > >> Hi Laszlo,
> > >>
> > >> There's already a float library used in OpensslLib.inf.
> > >>
> > >> [LibraryClasses.ARM]
> > >>   ArmSoftFloatLib
> > >>
> > >> The problem is that the below instance doesn't implement __aeabi_ui2d
> > >> and __aeabi_d2uiz (I encountered this one as well)
> > >>
> > >>   ArmPkg\Library\ArmSoftFloatLib\ArmSoftFloatLib.inf
> > >>
> > >> I think we can update this library support those two APIs. So what about
> > >> we still push the patch and file a BZ to fix this issue?
> > >
> > > I'm OK with that, but it will break ARM and AARCH64 platforms that
> > > consume OpensslLib (directly or through BaseCryptLib), so this question
> > > is up to Leif and Ard to decide.
> >
> > Correction: break ARM platforms only, not AARCH64.
> >
> 
> We obviously need to fix this before we can upgrade to a new OpenSSL version.
> 
> Do we really have a need for the random functions? These seem the only
> ones that use floating point, which the UEFI spec does not permit, so
> it would be better if we could fix this by removing the dependency on
> FP in the first place (and get rid of ArmSoftFloatLib entirely)
> 

BaseCryptLib provides RandSeed/RandBytes interface which wrap openssl rand
functionalities. These interfaces are used by following components in edk2

  - CryptoPkg\Library\TlsLib\TlsInit.c
  - SecurityPkg\HddPassword\HddPasswordDxe.c

Openssl components, like asn1, bn, evp, ocsp, pem, pkcs7, pkcs12, rsa, ssl (in addition
to cms, dsa, srp, which are disabled in edk2) will call rand_* interface as well.

Regards,
Jian

>