Re: [edk2-devel] Dependency on CryptoLib increases my module size by 600Kb, being apparently too big for integration

["Laszlo Ersek" <lersek@redhat.com>]

On 2/6/24 12:24, CrossedCarpet wrote:
> Greetings everyone , 
> Integration of my module into a motherboard bricks the computer.
> The integrator informed me that this might be happening due to the size
> of the module given that 600kB is too big and as such the code will be
> truncated once flashed.
> I find this suspicious given that this would render CryptoLib hard to
> use and I can also find modules like TlsDxe with sizes above 1Mb. 
> Perhaps there are other ways to call this library that don't include
> static linking?
> Where can I read more about this module size hard limit?
> Can someone give me any insight or tip on this subject?

(1) There are multiple instances of BaseCryptLib and OpensslLib.

For example, consider
"CryptoPkg/Library/BaseCryptLibOnProtocolPpi/DxeCryptLib.inf":
"Implements the BaseCryptLib and TlsLib using the services of the EDK II
Crypto Protocol".

(2) Which leads me to: "CryptoPkg/Driver/CryptoDxe.inf": "Produces the
EDK II Crypto Protocol using the library services from BaseCryptLib and
TlsLib.  PcdCryptoServiceFamilyEnable is used to enable the subset of
available services."

Refer to "CryptoPkg/Readme.md" on CryptoDxe configuration.

So, you may be able to (a) choose BaseCryptLib and/or OpensslLib
instances for linking statically into your module that contain the
actual crypto stuff, but a "trimmed" set of APIs (hopefully just what
you need), or (b) use such a cryptlib instance that actually consumes a
protocol and delegates the actual work to the CryptoDxe driver. Option
(b) however requires your platform integrator to include / expose
CryptoDxe, and then they need to configure the feature set of CryptoDxe
very carefully (see CryptoPkg/Readme.md), lest a crypto primitive proves
missing only at runtime. (With static linking and LTO, you have
build-time symbol resolution and just the required feature set included;
the problem is duplication across modules. With protocol / PPI
abstraction, modules can share the crypto logic, but determining the
*smallest sufficient* feature set for runtime, at build time, is a
challenge. AIUI.)

Laszlo



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#115173): https://edk2.groups.io/g/devel/message/115173
Mute This Topic: https://groups.io/mt/104195858/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-