Skip to content

Commit 84442aa

Browse files
tomi-fonttomi-font
committed
[nrf noup] revert update of MBEDTLS_BUILTIN CMake logic to Mbed TLS 4
Temporarily bring back the CMake logic that compiled Mbed TLS 3.6 before we actually update to Mbed TLS 4 in NCS. This is a revert of 393350f and subsequent changes affecting the Mbed TLS integration. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
1 parent ce5a1bd commit 84442aa

2 files changed

Lines changed: 211 additions & 69 deletions

File tree

‎modules/mbedtls/CMakeLists.txt‎

Lines changed: 211 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -5,88 +5,236 @@
55
#
66

77
if(CONFIG_MBEDTLS)
8-
9-
# Create an interface library named "mbedTLS":
10-
# - This is the library other modules/subsystems link against.
11-
# - It contains some Mbed TLS configuration flags (ex: MBEDTLS_CONFIG_FILE
12-
# and TF_PSA_CRYPTO_CONFIG_FILE) which are used in Mbed TLS build, but
13-
# which must also be defined when Zephyr code includes headers
14-
# from Mbed TLS.
15-
# - It contains public include directories which are provided by Mbed TLS.
168
zephyr_interface_library_named(mbedTLS)
179

1810
if(CONFIG_MBEDTLS_BUILTIN)
11+
if(CONFIG_MBEDTLS_ENTROPY_POLL_ZEPHYR AND NOT CONFIG_ENTROPY_HAS_DRIVER)
12+
message(WARNING "No entropy device on the system, using fake entropy source!")
13+
endif()
1914

20-
# Explicitly link zephyr_interface to mbedTLS
21-
zephyr_link_libraries(mbedTLS)
15+
if(CONFIG_MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
16+
if(CONFIG_MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG_ALLOW_NON_CSPRNG OR
17+
CONFIG_TEST_CSPRNG_GENERATOR)
18+
message(WARNING "
19+
Non cryptographycally secure sources are enabled for psa_generate_random().
20+
This is meant to be used only for tests, not in production!")
21+
else()
22+
if(NOT CONFIG_CSPRNG_ENABLED)
23+
message(FATAL_ERROR "
24+
MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is set but there is
25+
no CSPRNG enabled.")
26+
endif()
27+
endif()
28+
endif()
2229

30+
# Add the config-file entry point
2331
target_compile_definitions(mbedTLS INTERFACE
24-
MBEDTLS_CONFIG_FILE="${CONFIG_MBEDTLS_CONFIG_FILE}"
25-
TF_PSA_CRYPTO_CONFIG_FILE="${CONFIG_TF_PSA_CRYPTO_CONFIG_FILE}"
32+
MBEDTLS_CONFIG_FILE="${CONFIG_MBEDTLS_CONFIG_FILE}"
2633
)
2734

28-
# Some CMake variables that are used in Mbed TLS build
29-
set(CMAKE_POLICY_DEFAULT_CMP0077 NEW)
30-
set(MBEDTLS_AS_SUBPROJECT ON)
31-
set(ENABLE_PROGRAMS OFF)
32-
set(ENABLE_TESTING OFF)
33-
set(GEN_FILES OFF)
34-
# Workaround to get rid of a warning generated by the Mbed TLS build system.
35-
set(CMAKE_INSTALL_LIBDIR "lib" CACHE PATH "")
36-
set(TF_PSA_CRYPTO_DIR ${ZEPHYR_TF_PSA_CRYPTO_MODULE_DIR})
37-
set(MLDSA_NATIVE_DIR ${ZEPHYR_MLDSA_NATIVE_MODULE_DIR})
38-
39-
# Add Mbed TLS (TF-PSA-Crypto is automatically included from there).
40-
# This creates 3 libraries: mbedtls, mbedx509 and tfpsacrypto.
41-
add_subdirectory(${ZEPHYR_MBEDTLS_MODULE_DIR} mbedtls)
42-
43-
foreach(lib mbedtls mbedx509 tfpsacrypto builtin p256-m everest pqcp extras platform utilities)
44-
# Mbed TLS libraries are normal CMake libraries.
45-
# To ensure Mbed TLS libraries are including Zephyr include directories and
46-
# Zephyr compile options we link those libraries with 'zephyr_interface'.
47-
target_link_libraries(${lib} PRIVATE zephyr_interface)
48-
# Mbed TLS libraries are external CMake targets (not zephyr_library()),
49-
# so they miss the automatic add_dependencies on zephyr_generated_headers
50-
# that zephyr_library() targets get. Without this, generated headers
51-
# like heap_constants.h may not exist when Mbed TLS sources compile.
52-
add_dependencies(${lib} zephyr_generated_headers)
53-
endforeach()
54-
55-
# Custom macro to tell that a TF-PSA-Crypto source file is being compiled.
56-
# This is used by Secure Storage.
57-
target_compile_definitions(tfpsacrypto PRIVATE BUILDING_MBEDTLS_CRYPTO)
58-
59-
# Add Mbed TLS libraries ("tfpsacrypto" and "mbedx509" are linked to "mbedtls")
60-
# to ZEPHYR_LIBS list.
61-
zephyr_append_cmake_library(mbedtls)
62-
63-
# Add Mbed TLS public include directories to the "mbedTLS" interface library.
35+
if(CONFIG_BUILD_WITH_TFM)
36+
target_include_directories(mbedTLS INTERFACE
37+
$<TARGET_PROPERTY:tfm,TFM_BINARY_DIR>/api_ns/interface/include
38+
)
39+
endif()
40+
41+
# Add regular includes
6442
target_include_directories(mbedTLS INTERFACE
65-
$<TARGET_PROPERTY:mbedtls,INTERFACE_INCLUDE_DIRECTORIES>
43+
${ZEPHYR_CURRENT_MODULE_DIR}/include
6644
${ZEPHYR_CURRENT_MODULE_DIR}/include/library
6745
${ZEPHYR_CURRENT_MODULE_DIR}/library
46+
configs
47+
include
6848
)
6949

70-
# Add local include directories to the "mbedTLS" interface library.
71-
target_include_directories(mbedTLS INTERFACE
72-
${CMAKE_CURRENT_LIST_DIR}/configs
73-
${CMAKE_CURRENT_LIST_DIR}/include
50+
if(CONFIG_MBEDTLS_PSA_P256M_DRIVER_RAW)
51+
target_include_directories(mbedTLS INTERFACE
52+
${ZEPHYR_CURRENT_MODULE_DIR}/3rdparty/p256-m/p256-m
53+
)
54+
endif()
55+
56+
# Add base library with files required by all drivers/backends.
57+
zephyr_library_named(mbedTLSBase)
58+
59+
# Base mbed TLS files
60+
list(APPEND mbedtls_base_src
61+
${ZEPHYR_CURRENT_MODULE_DIR}/library/aes.c
62+
${ZEPHYR_CURRENT_MODULE_DIR}/library/aesni.c
63+
${ZEPHYR_CURRENT_MODULE_DIR}/library/aria.c
64+
${ZEPHYR_CURRENT_MODULE_DIR}/library/asn1parse.c
65+
${ZEPHYR_CURRENT_MODULE_DIR}/library/asn1write.c
66+
${ZEPHYR_CURRENT_MODULE_DIR}/library/base64.c
67+
${ZEPHYR_CURRENT_MODULE_DIR}/library/bignum_core.c
68+
${ZEPHYR_CURRENT_MODULE_DIR}/library/bignum_mod_raw.c
69+
${ZEPHYR_CURRENT_MODULE_DIR}/library/bignum_mod.c
70+
${ZEPHYR_CURRENT_MODULE_DIR}/library/bignum.c
71+
${ZEPHYR_CURRENT_MODULE_DIR}/library/block_cipher.c
72+
${ZEPHYR_CURRENT_MODULE_DIR}/library/camellia.c
73+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ccm.c
74+
${ZEPHYR_CURRENT_MODULE_DIR}/library/chacha20.c
75+
${ZEPHYR_CURRENT_MODULE_DIR}/library/chachapoly.c
76+
${ZEPHYR_CURRENT_MODULE_DIR}/library/cipher_wrap.c
77+
${ZEPHYR_CURRENT_MODULE_DIR}/library/cipher.c
78+
${ZEPHYR_CURRENT_MODULE_DIR}/library/cmac.c
79+
${ZEPHYR_CURRENT_MODULE_DIR}/library/constant_time.c
80+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ctr_drbg.c
81+
${ZEPHYR_CURRENT_MODULE_DIR}/library/debug.c
82+
${ZEPHYR_CURRENT_MODULE_DIR}/library/des.c
83+
${ZEPHYR_CURRENT_MODULE_DIR}/library/dhm.c
84+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ecdh.c
85+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ecdsa.c
86+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ecjpake.c
87+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ecp_curves_new.c
88+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ecp_curves.c
89+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ecp.c
90+
${ZEPHYR_CURRENT_MODULE_DIR}/library/entropy_poll.c
91+
${ZEPHYR_CURRENT_MODULE_DIR}/library/entropy.c
92+
${ZEPHYR_CURRENT_MODULE_DIR}/library/error.c
93+
${ZEPHYR_CURRENT_MODULE_DIR}/library/gcm.c
94+
${ZEPHYR_CURRENT_MODULE_DIR}/library/hkdf.c
95+
${ZEPHYR_CURRENT_MODULE_DIR}/library/hmac_drbg.c
96+
${ZEPHYR_CURRENT_MODULE_DIR}/library/lmots.c
97+
${ZEPHYR_CURRENT_MODULE_DIR}/library/lms.c
98+
${ZEPHYR_CURRENT_MODULE_DIR}/library/md.c
99+
${ZEPHYR_CURRENT_MODULE_DIR}/library/md5.c
100+
${ZEPHYR_CURRENT_MODULE_DIR}/library/memory_buffer_alloc.c
101+
${ZEPHYR_CURRENT_MODULE_DIR}/library/mps_reader.c
102+
${ZEPHYR_CURRENT_MODULE_DIR}/library/mps_trace.c
103+
${ZEPHYR_CURRENT_MODULE_DIR}/library/nist_kw.c
104+
${ZEPHYR_CURRENT_MODULE_DIR}/library/oid.c
105+
${ZEPHYR_CURRENT_MODULE_DIR}/library/padlock.c
106+
${ZEPHYR_CURRENT_MODULE_DIR}/library/platform_util.c
107+
${ZEPHYR_CURRENT_MODULE_DIR}/library/platform.c
108+
${ZEPHYR_CURRENT_MODULE_DIR}/library/poly1305.c
109+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_util.c
110+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ripemd160.c
111+
${ZEPHYR_CURRENT_MODULE_DIR}/library/rsa_alt_helpers.c
112+
${ZEPHYR_CURRENT_MODULE_DIR}/library/rsa.c
113+
${ZEPHYR_CURRENT_MODULE_DIR}/library/sha1.c
114+
${ZEPHYR_CURRENT_MODULE_DIR}/library/sha256.c
115+
${ZEPHYR_CURRENT_MODULE_DIR}/library/sha512.c
116+
${ZEPHYR_CURRENT_MODULE_DIR}/library/sha3.c
117+
${ZEPHYR_CURRENT_MODULE_DIR}/library/threading.c
118+
${ZEPHYR_CURRENT_MODULE_DIR}/library/timing.c
119+
${ZEPHYR_CURRENT_MODULE_DIR}/library/version_features.c
120+
${ZEPHYR_CURRENT_MODULE_DIR}/library/version.c
121+
zephyr_init.c
122+
zephyr_entropy.c
74123
)
75124

76-
# Add some support for legacy crypto that unfortunately is still required
77-
# in some scenarios.
78-
include(${CMAKE_CURRENT_LIST_DIR}/legacy_support.cmake)
125+
zephyr_library_sources(${mbedtls_base_src})
79126

80-
# Add another library to provide Zephyr-specific support
81-
zephyr_library()
82-
zephyr_library_sources(
83-
${CMAKE_CURRENT_LIST_DIR}/zephyr_init.c
84-
${CMAKE_CURRENT_LIST_DIR}/zephyr_entropy.c
85-
$<$<BOOL:${CONFIG_MBEDTLS_DEBUG}>:${CMAKE_CURRENT_LIST_DIR}/debug.c>
86-
$<$<BOOL:${CONFIG_MBEDTLS_SHELL}>:${CMAKE_CURRENT_LIST_DIR}/shell.c>
127+
zephyr_library_sources_ifdef(CONFIG_MBEDTLS_DEBUG debug.c)
128+
zephyr_library_sources_ifdef(CONFIG_MBEDTLS_SHELL shell.c)
129+
130+
zephyr_library_app_memory(k_mbedtls_partition)
131+
if(CONFIG_ARCH_POSIX AND CONFIG_ASAN AND NOT CONFIG_64BIT AND NOT CONFIG_NO_OPTIMIZATIONS)
132+
# i386 assembly code used in MBEDTLS does not compile with size optimization
133+
# if address sanitizer is enabled, as such switch default optimization level
134+
# to speed
135+
set_property(SOURCE ${ZEPHYR_CURRENT_MODULE_DIR}/library/bignum_core.c APPEND PROPERTY COMPILE_OPTIONS
136+
"${COMPILER_OPTIMIZE_FOR_SPEED_FLAG}")
137+
endif()
138+
139+
zephyr_library_link_libraries(mbedTLS)
140+
141+
zephyr_library_named(mbedTLSCrypto)
142+
143+
if(CONFIG_MBEDTLS_PSA_CRYPTO_C)
144+
list(APPEND crypto_source
145+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_crypto_aead.c
146+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_crypto_cipher.c
147+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_crypto_driver_wrappers_no_static.c
148+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_crypto_ecp.c
149+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_crypto_ffdh.c
150+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_crypto_hash.c
151+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_crypto_mac.c
152+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_crypto_pake.c
153+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_crypto_random.c
154+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_crypto_rsa.c
155+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_crypto_se.c
156+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_crypto_storage.c
157+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_its_file.c
158+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_crypto.c
159+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_crypto_client.c
160+
${ZEPHYR_CURRENT_MODULE_DIR}/library/psa_crypto_slot_management.c
161+
)
162+
endif()
163+
164+
if(CONFIG_MBEDTLS_PSA_P256M_DRIVER_ENABLED)
165+
list(APPEND crypto_source
166+
${ZEPHYR_CURRENT_MODULE_DIR}/3rdparty/p256-m/p256-m_driver_entrypoints.c
167+
${ZEPHYR_CURRENT_MODULE_DIR}/3rdparty/p256-m/p256-m/p256-m.c
168+
)
169+
zephyr_library_include_directories(${ZEPHYR_CURRENT_MODULE_DIR}/library)
170+
endif()
171+
172+
list(APPEND crypto_source
173+
${ZEPHYR_CURRENT_MODULE_DIR}/library/pem.c
174+
${ZEPHYR_CURRENT_MODULE_DIR}/library/pkcs12.c
175+
${ZEPHYR_CURRENT_MODULE_DIR}/library/pkcs5.c
176+
${ZEPHYR_CURRENT_MODULE_DIR}/library/pkparse.c
177+
${ZEPHYR_CURRENT_MODULE_DIR}/library/pkwrite.c
178+
${ZEPHYR_CURRENT_MODULE_DIR}/library/pk.c
179+
${ZEPHYR_CURRENT_MODULE_DIR}/library/pk_ecc.c
180+
${ZEPHYR_CURRENT_MODULE_DIR}/library/pk_wrap.c
181+
)
182+
183+
zephyr_library_sources(${crypto_source})
184+
185+
# Custom macro to tell that an mbedTLSCrypto source file is being compiled.
186+
zephyr_library_compile_definitions(BUILDING_MBEDTLS_CRYPTO)
187+
188+
zephyr_library_link_libraries(mbedTLS)
189+
190+
zephyr_library_link_libraries_ifdef(CONFIG_BUILD_WITH_TFM tfm_api)
191+
192+
zephyr_library_named(mbedTLSX509)
193+
194+
list(APPEND x509_source
195+
${ZEPHYR_CURRENT_MODULE_DIR}/library/x509.c
196+
${ZEPHYR_CURRENT_MODULE_DIR}/library/x509_create.c
197+
${ZEPHYR_CURRENT_MODULE_DIR}/library/x509_crl.c
198+
${ZEPHYR_CURRENT_MODULE_DIR}/library/x509_crt.c
199+
${ZEPHYR_CURRENT_MODULE_DIR}/library/x509_csr.c
200+
${ZEPHYR_CURRENT_MODULE_DIR}/library/x509write_crt.c
201+
${ZEPHYR_CURRENT_MODULE_DIR}/library/x509write_csr.c
202+
${ZEPHYR_CURRENT_MODULE_DIR}/library/x509write.c
87203
)
204+
205+
zephyr_library_sources(${x509_source})
206+
88207
zephyr_library_link_libraries(mbedTLS)
89208

209+
zephyr_library()
210+
211+
list(APPEND mbedtls_source
212+
${ZEPHYR_CURRENT_MODULE_DIR}/library/net_sockets.c
213+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ssl_cache.c
214+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ssl_ciphersuites.c
215+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ssl_client.c
216+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ssl_cookie.c
217+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ssl_debug_helpers_generated.c
218+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ssl_msg.c
219+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ssl_ticket.c
220+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ssl_tls12_client.c
221+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ssl_tls12_server.c
222+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ssl_tls13_client.c
223+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ssl_tls13_generic.c
224+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ssl_tls13_keys.c
225+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ssl_tls13_server.c
226+
${ZEPHYR_CURRENT_MODULE_DIR}/library/ssl_tls.c
227+
)
228+
229+
zephyr_library_sources(${mbedtls_source})
230+
231+
zephyr_library_link_libraries(
232+
mbedTLSX509
233+
mbedTLSCrypto
234+
mbedTLSBase
235+
mbedTLS
236+
)
237+
90238
elseif(CONFIG_MBEDTLS_LIBRARY)
91239
# NB: CONFIG_MBEDTLS_LIBRARY is not regression tested and is
92240
# therefore susceptible to bit rot

‎modules/mbedtls/Kconfig‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,6 @@ config MBEDTLS_PROMPTLESS
1414
mbed TLS menu prompt and instead handle the selection of MBEDTLS from
1515
dependent sub-configurations and thus prevent stuck symbol behavior.
1616

17-
config MBEDTLS_VERSION_4_x
18-
bool
19-
default y
20-
help
21-
Hidden Kconfig symbol used internally to mark support for Mbed TLS 4.x.
22-
2317
rsource "Kconfig.psa.auto"
2418
rsource "Kconfig.psa.logic"
2519

0 commit comments

Comments
 (0)