Skip to content

Matter changes for Mbed TLS update to v4.1.0#718

Merged
carlescufi merged 10 commits into
nrfconnect:masterfrom
tomi-font:mbedtls_update_4.1.0
May 22, 2026
Merged

Matter changes for Mbed TLS update to v4.1.0#718
carlescufi merged 10 commits into
nrfconnect:masterfrom
tomi-font:mbedtls_update_4.1.0

Conversation

@tomi-font
Copy link
Copy Markdown
Contributor

@tomi-font tomi-font commented Apr 28, 2026 •
edited
Loading

manifest-pr-skip

Testing

NCS PR: nrfconnect/sdk-nrf/pull/28496

@tomi-font tomi-font requested a review from a team as a code owner April 28, 2026 10:43
@tomi-font tomi-font force-pushed the mbedtls_update_4.1.0 branch from ca5b983 to 207f2ad Compare May 4, 2026 11:54
@NordicBuilder NordicBuilder mentioned this pull request May 4, 2026
Merged
@tomi-font tomi-font changed the title changes for Mbed TLS 4.1.0 update Matter changes for Mbed TLS update to v4.1.0 May 12, 2026
@tomi-font tomi-font force-pushed the mbedtls_update_4.1.0 branch from be416d5 to fdd3558 Compare May 15, 2026 06:12
@CLAassistant
Copy link
Copy Markdown

CLAassistant commented May 15, 2026

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ tomi-font
❌ Vge0rge
You have signed the CLA already but the status is still pending? Let us recheck it.

@tomi-font tomi-font force-pushed the mbedtls_update_4.1.0 branch 2 times, most recently from 5c9471a to bba025b Compare May 18, 2026 09:21
LuDuda
LuDuda approved these changes May 18, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@LuDuda LuDuda left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@kkasperczyk-no can you take a look from commits perspective? There are few noups and toups. At some point we would need to upstream the commits -> though upstream might need some #ifdefs for mbedTLS version as paths changed..

@tomi-font
Copy link
Copy Markdown
Contributor Author

tomi-font commented May 18, 2026

Thanks for having a look @LuDuda!
@Vge0rge is still working on the remaining failures for OT/Matter.
I think indeed his commits should be marked as toup, but we will let you manage.

And yes, definitely take a look at the changes we made (in the nrfxlib PR too) and please make sure that things run properly too. 🙂

@kkasperczyk-no
Copy link
Copy Markdown
Contributor

kkasperczyk-no commented May 19, 2026 •
edited
Loading

LGTM 👍

@kkasperczyk-no can you take a look from commits perspective? There are few noups and toups. At some point we would need to upstream the commits -> though upstream might need some #ifdefs for mbedTLS version as paths changed..

Unless there is a very important reason for keeping it as a nordic patch I would suggest making all commits as nrf toups, so we could contribute it and would not need to maintain the no up in the future.

And yes, if changing include paths is required probably it would be a good idea to use ifdef with mbedtls version, otherwise it will fail for the other platforms that have not switched to newer version yet. Alternative solution is using ifdef for CHIP_PLATFORM_NRFCONNECT, but this is a last resort solution in the common files.

@tomi-font tomi-font force-pushed the mbedtls_update_4.1.0 branch 2 times, most recently from a0da682 to a1645ce Compare May 20, 2026 16:12
LuDuda
LuDuda approved these changes May 21, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@LuDuda LuDuda left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

Changes seems fine and reasonable. Thanks.

tomi-font and others added 7 commits May 21, 2026 14:23
@tomi-font
[nrf toup] remove CONFIG_OPENTHREAD_NRF_SECURITY_CHOICE
a3a2a5e 
This option is removed from NCS.

Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
@tomi-font
[nrf toup] rename PSA_KEY_HANDLE_FROM_CRACEN_KMU_SLOT
98ae10b 
To PSA_KEY_ID_FROM_CRACEN_KMU_SLOT. Renaming was done in sdk-nrf.

Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
@Vge0rge @tomi-font
[nrf noup] Update crypto configuration variables
aedf8cc 
With the new TF-PSA-CRYPTO there are renames in the variables:
MBEDTLS_PSA_CRYPTO_CONFIG_FILE -> TF_PSA_CRYPTO_CONFIG_FILE
MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE -> TF_PSA_CRYPTO_USER_CONFIG_FILE

Rename these variables accordingly here.

Noup as the upstream repo still compiles with mbedTLS 3.6.5 which
does not have these names.

Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
@Vge0rge @tomi-font
[nrf noup] config: Remove nrf-config.h parameter
a93f9d7 
This is not used anymore when TLS is not enabled.

I need to double check if this causes any problem when TLS
is enabled and remove this message later :)

Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
@tomi-font
[nrf toup] remove enabling of CONFIG_NORDIC_SECURITY_BACKEND
f87290a 
It has been removed. Replace it with CONFIG_PSA_CRYPTO.

In addition, fix some spacing issues in the same file.

Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
@tomi-font
[nrf toup] adjust Mbed TLS configuration defaults
7ae1b32 
Remove options that are gone.

Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
@Vge0rge @tomi-font
config: Remove OBERON_BACKEND
ea85da9 
The mbedTLS legacy crypto library with Oberon is not available
with the new TF-PSA-Crypto and thus this Kconfig option is removed.

Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
@tomi-font tomi-font force-pushed the mbedtls_update_4.1.0 branch 2 times, most recently from 952709f to ee07117 Compare May 21, 2026 12:25
Vge0rge added 2 commits May 21, 2026 15:26
@Vge0rge @tomi-font
[nrf toup] crypto: Update includes for mbedTLS > 4
b5c2264 
Guard the includes depending on the Mbed TLS version.

Also ecp.h now lives inside the TF-PSA-Crypto repo, and they chaged
the path add a private prefix, so adapt to that as well.

Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
@Vge0rge @tomi-font
[nrf toup] crypto: Removed unused include
331dfcb 
x509_csr.h seems to be unsed in CHIPCryptoPALPSA.cpp
so remove it.

Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
@Vge0rge @tomi-font
[nrf noup] crypto: Guard unused includes
cc79ba8 
Guard all the mbedTLS related includes based on the
CHIP_CRYPTO_USE_X509 define, since when this is not defined
all the functions in the file seem to just return an error
of not supported and thus the includes are not used.

Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
@tomi-font tomi-font force-pushed the mbedtls_update_4.1.0 branch from ee07117 to cc79ba8 Compare May 21, 2026 12:27
@carlescufi carlescufi merged commit 106cf3d into nrfconnect:master May 22, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@LuDuda LuDuda LuDuda approved these changes

Assignees

No one assigned

Labels

config crypto examples nrf connect platform

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@tomi-font @CLAassistant @kkasperczyk-no @LuDuda @carlescufi @Vge0rge