Add TF-PSA-Crypto pk and threading API

.github/workflows/test-psa-api.yml

@@ -110,3 +110,10 @@ jobs:
           make -C test psa_devid_cryptocb_test ASAN=1
           rm -rf .store test/.store
           ./test/psa_devid_cryptocb_test
+
+      # LeakSanitizer checks that failed key file loads free their buffer
+      - name: Run the pk test under AddressSanitizer
+        run: |
+          rm -f test/psa_tf_psa_pk_test test/psa_server/psa_tf_psa_pk_test.o
+          make -C test psa_tf_psa_pk_test ASAN=1
+          ./test/psa_tf_psa_pk_test

.gitignore

@@ -92,5 +92,9 @@ test/psa_zero_capacity_buffer_test
 test/psa_aead_gcm_short_tag_test
 test/psa_enrollment_alg_test
 build-test/out/
+test/psa_tf_psa_pk_test
+test/psa_tf_psa_threading_test
+test/build-threads
+test/build-threads-asan
 .cache/
 compile_commands.json

Makefile

@@ -79,6 +79,17 @@ WOLFCRYPT_SRC := \
 WOLFCRYPT_OBJ := $(patsubst $(WOLFSSL_PATH)/wolfcrypt/src/%.c,$(OBJDIR)/wolfcrypt_%.o,$(WOLFCRYPT_SRC))
 WOLFCRYPT_OBJ_PIC := $(patsubst $(WOLFSSL_PATH)/wolfcrypt/src/%.c,$(OBJDIR_PIC)/wolfcrypt_%.o,$(WOLFCRYPT_SRC))
 
+# MBEDTLS_THREADING_C=1 builds a thread safe library, as in Mbed TLS. See
+# user_settings.h. Applications define MBEDTLS_THREADING_C too.
+ifeq ($(MBEDTLS_THREADING_C),1)
+CPPFLAGS += -DMBEDTLS_THREADING_C
+LDFLAGS += -pthread
+endif
+
+# Changing MBEDTLS_THREADING_C rebuilds every object
+OPTIONS_STAMP := $(BUILD_DIR)/options_$(if \
+	$(filter 1,$(MBEDTLS_THREADING_C)),threads,nothreads)
+
 WOLFSSL_CPPFLAGS ?= -DWOLFSSL_USER_SETTINGS
 
 CPPFLAGS += -I$(WOLFSSL_PATH) -I$(USER_SETTINGS_PATH) \
@@ -161,6 +172,13 @@ want-surface-test: $(LIBNAME) $(SHLIBNAME)
 		-lpthread -lm
 	$(BUILD_DIR)/psa_want_surface_test
 
+$(OBJ) $(WOLFCRYPT_OBJ) $(OBJ_PIC) $(WOLFCRYPT_OBJ_PIC): $(OPTIONS_STAMP)
+
+$(OPTIONS_STAMP):
+	@mkdir -p $(@D)
+	rm -f $(BUILD_DIR)/options_*
+	touch $@
+
 $(OBJDIR)/%.o: src/%.c
 	@mkdir -p $(OBJDIR)
 	$(CC) $(CPPFLAGS) $(DEPFLAGS) $(CFLAGS) -c $< -o $@
@@ -241,7 +259,9 @@ UNIT_TESTS := psa_api_test \
 	psa_zero_capacity_buffer_test \
 	psa_want_surface_test \
 	psa_tf_psa_extra_test \
-	psa_aead_gcm_short_tag_test
+	psa_aead_gcm_short_tag_test \
+	psa_tf_psa_pk_test \
+	psa_tf_psa_threading_test
 
 # Run the unit test loop from the repo root (psa_rsa_pss_interop_test reads
 # its certificate relative to the root). Assumes the tests are already built.

README.md

@@ -10,6 +10,10 @@ wolfPSA is a PSA Crypto **engine** that implements the PSA Crypto API on
 - wolfCrypt as the backend crypto provider.
 - The default make target creates a static library (`libwolfpsa.a`) built directly
   from wolfPSA sources plus the required wolfCrypt objects.
+- TF-PSA-Crypto's `mbedtls/pk.h` for private keys: `mbedtls_pk_init`, `free`,
+  `parse_key`, `parse_keyfile` and `can_do_psa`. The context has the key's
+  DER and type. RSA and EC keys, PEM or DER, traditional or PKCS #8.
+  Encrypted keys and EC keys with a compressed public key are not supported.
 
 ## Repository layout
 
@@ -60,6 +64,18 @@ AddressSanitizer build:
 make ASAN=1
 ```
 
+Thread-safe build, as Mbed TLS with `MBEDTLS_THREADING_C`: wolfCrypt without
+`SINGLE_THREADED`, a mutex around the key store (`WOLFPSA_THREAD_SAFE`, see
+`src/psa_lock.h`) and the TF-PSA-Crypto threading API in
+`mbedtls/threading.h`, on pthreads:
+
+```
+make MBEDTLS_THREADING_C=1
+```
+
+Applications define `MBEDTLS_THREADING_C` too, as in their Mbed TLS
+configuration, and link with `-pthread`.
+
 You can override the wolfSSL source location:
 
 ```