Skip to content

Commit bb1dcb5

Browse files
tomi-fonttomi-font
committed
modules: tf-m: adapt to TF-PSA-Crypto
Changes include: - Updating TF-M revision with changes needed in the repo. - Removing the unnecessary installation of many PSA Crypto header files. - Adjusting include directories of psa_interface and moving them to a dedicated common CMake file instead of duplicating them. - Moving the MBEDTLS_PLATFORM_*_ALT configs from the Mbed TLS to the crypto library config file (MBEDTLS_PLATFORM_PRINTF_ALT was needed for TF-M, MBEDTLS_ENTROPY_HARDWARE_ALT is gone with Mbed TLS 4, MBEDTLS_PLATFORM_ZEROIZE_ALT wasn't properly integrated). - Some cleanup here and there. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
1 parent 74ba0ac commit bb1dcb5

13 files changed

Lines changed: 45 additions & 121 deletions

File tree

‎modules/trusted-firmware-m/tfm_boards/external_core.cmake‎

Lines changed: 1 addition & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -27,26 +27,9 @@ if(TARGET tfm_api_ns)
2727
)
2828
endif()
2929

30-
# Duplicates that can be removed
31-
#set(TFM_MBEDCRYPTO_CONFIG_PATH ${CONFIG_MBEDTLS_CONFIG_FILE})
32-
#set(TFM_MBEDCRYPTO_PSA_CRYPTO_CONFIG_PATH ${CONFIG_TF_PSA_CRYPTO_CONFIG_FILE})
33-
#set(TFM_MBEDCRYPTO_PSA_CRYPTO_USER_CONFIG_PATH ${CONFIG_TF_PSA_CRYPTO_USER_CONFIG_FILE})
34-
35-
# Note: This is a duplicate from nrf_security/CMakeLists.txt
36-
# with additions of the install-target for Oberon-psa-core includes
3730
if(TARGET psa_interface)
3831
set(EXTERNAL_CRYPTO_CORE_HANDLED_PSA_INTERFACE True)
39-
target_include_directories(psa_interface
40-
INTERFACE
41-
${NRF_SECURITY_DIR}/include
42-
$<BUILD_INTERFACE:${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/include>
43-
# Oberon library
44-
${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/library
45-
# Mbed TLS (mbedcrypto) PSA headers
46-
${ZEPHYR_MBEDTLS_MODULE_DIR}/library
47-
${ZEPHYR_MBEDTLS_MODULE_DIR}/include
48-
${ZEPHYR_MBEDTLS_MODULE_DIR}/include/library
49-
)
32+
include(${NRF_SECURITY_DIR}/cmake/psa_interface_include_directories.cmake)
5033
endif()
5134

5235
# Constructing config libraries in partition/crypto/CMakeLists.txt

‎modules/trusted-firmware-m/tfm_boards/external_core_install.cmake‎

Lines changed: 0 additions & 43 deletions
This file was deleted.

‎subsys/nrf_security/CMakeLists.txt‎

Lines changed: 7 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ if(CONFIG_BUILD_WITH_TFM OR CONFIG_PSA_SSF_CRYPTO_CLIENT)
4444

4545
# Add replacement platform.c for NS build
4646
list(APPEND src_zephyr
47-
${ZEPHYR_MBEDTLS_MODULE_DIR}/library/platform.c
47+
${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/platform/platform.c
4848
)
4949

5050
# The current version of the mbed TLS deliverables requires mbedcrypto built
@@ -54,10 +54,7 @@ if(CONFIG_BUILD_WITH_TFM OR CONFIG_PSA_SSF_CRYPTO_CLIENT)
5454

5555
get_cmake_property(all_vars VARIABLES)
5656

57-
# 1. Non-secure should not build the PSA core or drivers
58-
set(CONFIG_MBEDTLS_PSA_CRYPTO_C False)
59-
60-
# 2. Enable OBERON_BACKEND, disable CC3XX_BACKEND
57+
# Enable OBERON_BACKEND, disable CC3XX_BACKEND
6158
set(CONFIG_NRF_OBERON True)
6259
set(CONFIG_OBERON_BACKEND True)
6360
set(CONFIG_CC3XX_BACKEND False)
@@ -66,7 +63,7 @@ if(CONFIG_BUILD_WITH_TFM OR CONFIG_PSA_SSF_CRYPTO_CLIENT)
6663
set(CONFIG_NRF_CC3XX_PLATFORM False)
6764
set(CONFIG_PSA_CRYPTO_DRIVER_CC3XX False)
6865

69-
# 3. Special case: _ALT in CC3XX, not in OBERON (set to False)
66+
# Special case: _ALT in CC3XX, not in OBERON (set to False)
7067
set(CONFIG_MBEDTLS_AES_ALT False)
7168
set(CONFIG_MBEDTLS_CCM_ALT False)
7269
set(CONFIG_MBEDTLS_CHACHAPOLY_ALT False)
@@ -76,11 +73,11 @@ if(CONFIG_BUILD_WITH_TFM OR CONFIG_PSA_SSF_CRYPTO_CLIENT)
7673
set(CONFIG_MBEDTLS_DHM_ALT False)
7774
set(CONFIG_MBEDTLS_RSA_ALT False)
7875

79-
# 4. Special case: _ALT in ECJPAKE (only in OBERON, set to True)
80-
# Only has effect if ECJPAKE is enabled
76+
# Special case: _ALT in ECJPAKE (only in OBERON, set to True)
77+
# Only has effect if ECJPAKE is enabled
8178
set(CONFIG_MBEDTLS_ECJPAKE_ALT True)
8279

83-
# 5. Special case: Handle platform specific configurations
80+
# Special case: Handle platform specific configurations
8481
set(CONFIG_MBEDTLS_PLATFORM_EXIT_ALT False)
8582
set(CONFIG_MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT False)
8683
else()
@@ -112,14 +109,7 @@ target_compile_definitions(psa_crypto_library_config
112109
# The name and intent of this comes from TF-M distribution
113110
add_library(psa_interface INTERFACE)
114111

115-
target_include_directories(psa_interface
116-
INTERFACE
117-
${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/include
118-
${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/library
119-
${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/core/
120-
${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/dispatch/
121-
${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/platform/
122-
)
112+
include(cmake/psa_interface_include_directories.cmake)
123113

124114
# Finally adding the crypto lib
125115
add_subdirectory(${ZEPHYR_NRFXLIB_MODULE_DIR}/crypto crypto_copy)

‎subsys/nrf_security/Kconfig.legacy‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -64,10 +64,6 @@ config MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT
6464
default y if CC3XX_BACKEND || PSA_CRYPTO_DRIVER_CC3XX
6565
depends on !BUILD_WITH_TFM
6666

67-
config MBEDTLS_ENTROPY_HARDWARE_ALT
68-
bool
69-
default y
70-
7167
config MBEDTLS_THREADING_ALT
7268
bool
7369
default y if CC3XX_BACKEND || MBEDTLS_PSA_CRYPTO_C

‎subsys/nrf_security/cmake/nrf_config.cmake‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,6 @@ kconfig_check_and_set_base(MBEDTLS_DEBUG_C)
1414
kconfig_check_and_set_base(MBEDTLS_THREADING_C)
1515
kconfig_check_and_set_base(MBEDTLS_THREADING_ALT)
1616

17-
# Platform configurations for _ALT defines
18-
kconfig_check_and_set_base(MBEDTLS_PLATFORM_EXIT_ALT)
19-
kconfig_check_and_set_base(MBEDTLS_PLATFORM_FPRINTF_ALT)
20-
kconfig_check_and_set_base(MBEDTLS_PLATFORM_PRINTF_ALT)
21-
kconfig_check_and_set_base(MBEDTLS_PLATFORM_SNPRINTF_ALT)
22-
kconfig_check_and_set_base(MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT)
23-
kconfig_check_and_set_base(MBEDTLS_ENTROPY_HARDWARE_ALT)
24-
kconfig_check_and_set_base(MBEDTLS_THREADING_ALT)
25-
kconfig_check_and_set_base(MBEDTLS_PLATFORM_ZEROIZE_ALT)
26-
2717
# Legacy configurations for _ALT defines
2818
kconfig_check_and_set_base(MBEDTLS_AES_SETKEY_ENC_ALT)
2919
kconfig_check_and_set_base(MBEDTLS_AES_SETKEY_DEC_ALT)

‎subsys/nrf_security/cmake/psa_crypto_config.cmake‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,13 @@ kconfig_check_and_set_base(MBEDTLS_PLATFORM_MEMORY)
2020
kconfig_check_and_set_base(MBEDTLS_PLATFORM_NO_STD_FUNCTIONS)
2121
kconfig_check_and_set_base(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
2222

23+
# Platform _ALT
24+
kconfig_check_and_set_base_to_one(MBEDTLS_PLATFORM_EXIT_ALT)
25+
kconfig_check_and_set_base_to_one(MBEDTLS_PLATFORM_FPRINTF_ALT)
26+
kconfig_check_and_set_base_to_one(MBEDTLS_PLATFORM_PRINTF_ALT)
27+
kconfig_check_and_set_base_to_one(MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT)
28+
kconfig_check_and_set_base_to_one(MBEDTLS_PLATFORM_SNPRINTF_ALT)
29+
2330
# TF-M
2431
kconfig_check_and_set_base_to_one(MBEDTLS_PSA_CRYPTO_SPM)
2532

‎subsys/nrf_security/cmake/psa_interface_include_directories.cmake‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#
2+
# Copyright (c) 2026 Nordic Semiconductor
3+
#
4+
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
#
6+
7+
target_include_directories(psa_interface
8+
INTERFACE
9+
${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/include
10+
${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/library
11+
${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/core
12+
${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/dispatch
13+
${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/platform
14+
${NRF_SECURITY_DIR}/include
15+
)

‎subsys/nrf_security/configs/nrf-config.h.template‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,6 @@
2020
#cmakedefine MBEDTLS_NO_PLATFORM_ENTROPY
2121
#cmakedefine MBEDTLS_DEBUG_C
2222

23-
/* Platform configurations for _ALT defines */
24-
#cmakedefine MBEDTLS_PLATFORM_EXIT_ALT
25-
#cmakedefine MBEDTLS_PLATFORM_FPRINTF_ALT
26-
#cmakedefine MBEDTLS_PLATFORM_PRINTF_ALT
27-
#cmakedefine MBEDTLS_PLATFORM_SNPRINTF_ALT
28-
#cmakedefine MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT
29-
#cmakedefine MBEDTLS_ENTROPY_HARDWARE_ALT
30-
3123
/* Threading configurations */
3224
#cmakedefine MBEDTLS_THREADING_C
3325
#cmakedefine MBEDTLS_THREADING_ALT

‎subsys/nrf_security/configs/psa_crypto_config.h.template‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,13 @@
2323
#cmakedefine MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
2424
#cmakedefine MBEDTLS_MEMORY_BUFFER_ALLOC_C
2525

26+
/* Platform _ALT */
27+
#cmakedefine MBEDTLS_PLATFORM_EXIT_ALT
28+
#cmakedefine MBEDTLS_PLATFORM_FPRINTF_ALT
29+
#cmakedefine MBEDTLS_PLATFORM_PRINTF_ALT
30+
#cmakedefine MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT
31+
#cmakedefine MBEDTLS_PLATFORM_SNPRINTF_ALT
32+
2633
/* TF-M */
2734
#cmakedefine MBEDTLS_PSA_CRYPTO_SPM
2835

‎subsys/nrf_security/src/CMakeLists.txt‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -171,8 +171,7 @@ endif()
171171
# Add drivers (for legacy and PSA crypto build)
172172
add_subdirectory(drivers)
173173

174-
# Add legacy Mbed TLS APIs
175-
if(CONFIG_MBEDTLS_LEGACY_CRYPTO_C OR (CONFIG_NRF_OBERON AND CONFIG_BUILD_WITH_TFM))
174+
if(CONFIG_MBEDTLS_LEGACY_CRYPTO_C)
176175
add_subdirectory(legacy)
177176
endif()
178177

0 commit comments

Comments
 (0)