mirror of
https://github.com/espressif/esp-idf.git
synced 2026-04-27 19:13:21 +00:00
feat: migrates mbedtls to PSA APIs
This commit is contained in:
Ashish Sharma
committed by
Mahavir Jain
Mahavir Jain
parent
c4dafbe27f
commit
7310184949
@@ -28,7 +28,13 @@ if(NOT ${IDF_TARGET} STREQUAL "linux")
|
||||
endif()
|
||||
|
||||
set(mbedtls_srcs "")
|
||||
set(mbedtls_include_dirs "port/include" "mbedtls/include" "mbedtls/library")
|
||||
set(mbedtls_include_dirs
|
||||
"port/include"
|
||||
"mbedtls/include"
|
||||
"mbedtls/library"
|
||||
"mbedtls/tf-psa-crypto/core"
|
||||
"mbedtls/tf-psa-crypto/drivers/builtin/src/"
|
||||
)
|
||||
|
||||
if(CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL)
|
||||
list(APPEND mbedtls_include_dirs "port/mbedtls_rom")
|
||||
@@ -39,12 +45,17 @@ if(CONFIG_MBEDTLS_CERTIFICATE_BUNDLE)
|
||||
list(APPEND mbedtls_include_dirs "esp_crt_bundle/include")
|
||||
endif()
|
||||
|
||||
list(APPEND mbedtls_include_dirs "${COMPONENT_DIR}/port/psa_driver/include")
|
||||
|
||||
idf_component_register(SRCS "${mbedtls_srcs}"
|
||||
INCLUDE_DIRS "${mbedtls_include_dirs}"
|
||||
PRIV_REQUIRES "${priv_requires}"
|
||||
REQUIRES "${requires}"
|
||||
)
|
||||
|
||||
# Add MBEDTLS_MAJOR_VERSION definition to the component library
|
||||
target_compile_definitions(${COMPONENT_LIB} INTERFACE MBEDTLS_MAJOR_VERSION=4)
|
||||
|
||||
# Determine the type of mbedtls component library
|
||||
if(mbedtls_srcs STREQUAL "")
|
||||
# For no sources in component library we must use "INTERFACE"
|
||||
@@ -130,6 +141,8 @@ if(CONFIG_MBEDTLS_CERTIFICATE_BUNDLE)
|
||||
list(APPEND include_dirs "${COMPONENT_DIR}/esp_crt_bundle/include")
|
||||
endif()
|
||||
|
||||
list(APPEND include_dirs "${COMPONENT_DIR}/port/psa_driver/include")
|
||||
|
||||
include_directories(${include_dirs})
|
||||
|
||||
# Needed to for mbedtls_rom includes to work from within mbedtls
|
||||
@@ -137,6 +150,13 @@ if(CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL)
|
||||
include_directories("${COMPONENT_DIR}/port/mbedtls_rom")
|
||||
endif()
|
||||
|
||||
# Set TF_PSA_CRYPTO_CONFIG_FILE before processing subdirectories to prevent override
|
||||
set(
|
||||
TF_PSA_CRYPTO_USER_CONFIG_FILE "mbedtls/esp_config.h"
|
||||
CACHE STRING "Path to the PSA Crypto configuration file"
|
||||
FORCE
|
||||
)
|
||||
|
||||
# Import mbedtls library targets
|
||||
add_subdirectory(mbedtls)
|
||||
|
||||
@@ -146,21 +166,49 @@ list(REMOVE_ITEM src_tls net_sockets.c)
|
||||
set_property(TARGET mbedtls PROPERTY SOURCES ${src_tls})
|
||||
|
||||
if(CONFIG_MBEDTLS_SSL_PROTO_GMTSSL1_1)
|
||||
get_target_property(src_tls mbedtls SOURCES)
|
||||
list(REMOVE_ITEM src_tls ssl_ciphersuites.c ssl_cli.c ssl_tls.c)
|
||||
set_property(TARGET mbedtls PROPERTY SOURCES ${src_tls})
|
||||
get_target_property(src_tls mbedtls SOURCES)
|
||||
list(REMOVE_ITEM src_tls ssl_ciphersuites.c ssl_cli.c ssl_tls.c)
|
||||
set_property(TARGET mbedtls PROPERTY SOURCES ${src_tls})
|
||||
|
||||
get_target_property(src_crypto mbedcrypto SOURCES)
|
||||
list(REMOVE_ITEM src_crypto cipher_wrap.c ecdsa.c ecp.c ecp_curves.c oid.c pk_wrap.c)
|
||||
set_property(TARGET mbedcrypto PROPERTY SOURCES ${src_crypto})
|
||||
message(STATUS "Setting up mbedtls")
|
||||
|
||||
get_target_property(src_x509 mbedx509 SOURCES)
|
||||
list(REMOVE_ITEM src_x509 x509_crt.c)
|
||||
set_property(TARGET mbedx509 PROPERTY SOURCES ${src_x509})
|
||||
# list(REMOVE_ITEM src_crypto sha512.c)
|
||||
# list(REMOVE_ITEM src_crypto cipher_wrap.c ecdsa.c ecp.c ecp_curves.c oid.c pk_wrap.c)
|
||||
# set_property(TARGET tfpsacrypto PROPERTY SOURCES ${src_crypto})
|
||||
|
||||
get_target_property(src_builtin builtin SOURCES)
|
||||
message(STATUS "src_builtin: ${src_builtin}")
|
||||
|
||||
get_target_property(src_x509 mbedx509 SOURCES)
|
||||
list(REMOVE_ITEM src_x509 x509_crt.c)
|
||||
set_property(TARGET mbedx509 PROPERTY SOURCES ${src_x509})
|
||||
endif()
|
||||
|
||||
# Core libraries from the mbedTLS project
|
||||
set(mbedtls_targets mbedtls mbedcrypto mbedx509)
|
||||
set(mbedtls_targets mbedtls mbedx509 tfpsacrypto builtin)
|
||||
|
||||
target_include_directories(tfpsacrypto PUBLIC "port/include")
|
||||
target_include_directories(tfpsacrypto PRIVATE "port/psa_crypto_storage/include")
|
||||
|
||||
if(CONFIG_MBEDTLS_HARDWARE_SHA OR CONFIG_MBEDTLS_HARDWARE_AES)
|
||||
target_include_directories(tfpsacrypto PUBLIC "${COMPONENT_DIR}/port/psa_driver/include")
|
||||
endif()
|
||||
|
||||
message(STATUS "Setting up mbedtls configuration")
|
||||
foreach(target ${mbedtls_targets})
|
||||
target_compile_definitions(${target} PUBLIC -DMBEDTLS_CONFIG_FILE="mbedtls/esp_config.h")
|
||||
set_config_files_compile_definitions(${target})
|
||||
target_compile_definitions(${target} PUBLIC MBEDTLS_MAJOR_VERSION=4)
|
||||
if(CONFIG_COMPILER_STATIC_ANALYZER AND CMAKE_C_COMPILER_ID STREQUAL "GNU") # TODO IDF-10087
|
||||
target_compile_options(${target} PRIVATE "-fno-analyzer")
|
||||
endif()
|
||||
if(CONFIG_MBEDTLS_COMPILER_OPTIMIZATION_SIZE)
|
||||
target_compile_options(${target} PRIVATE "-Os")
|
||||
elseif(CONFIG_MBEDTLS_COMPILER_OPTIMIZATION_PERF)
|
||||
target_compile_options(${target} PRIVATE "-O2")
|
||||
endif()
|
||||
endforeach()
|
||||
|
||||
# 3rd party libraries from the mbedTLS project
|
||||
list(APPEND mbedtls_targets everest p256m)
|
||||
|
||||
@@ -169,10 +217,33 @@ set(mbedtls_target_sources "${COMPONENT_DIR}/port/mbedtls_debug.c"
|
||||
|
||||
if(CONFIG_MBEDTLS_VER_4_X_SUPPORT)
|
||||
list(APPEND mbedtls_target_sources "${COMPONENT_DIR}/port/esp_psa_crypto_init.c")
|
||||
# Add ESP-IDF NVS-based PSA ITS implementation
|
||||
# Only compile esp_psa_its.c if nvs_flash component is available
|
||||
if(NOT ${IDF_TARGET} STREQUAL "linux")
|
||||
if(IDF_BUILD_V2)
|
||||
# For v2: conditionally compile source and link only if nvs_flash target exists
|
||||
target_sources(
|
||||
tfpsacrypto PRIVATE
|
||||
"$<$<TARGET_EXISTS:idf::nvs_flash>:${COMPONENT_DIR}/port/psa_crypto_storage/esp_psa_its.c>"
|
||||
)
|
||||
target_link_libraries(tfpsacrypto PRIVATE "$<$<TARGET_EXISTS:idf::nvs_flash>:idf::nvs_flash>")
|
||||
# Define compile definition to indicate ESP-IDF PSA ITS implementation is available
|
||||
target_compile_definitions(tfpsacrypto PRIVATE "$<$<TARGET_EXISTS:idf::nvs_flash>:ESP_PSA_ITS_AVAILABLE>")
|
||||
else()
|
||||
# For v1: check if component is in build before adding source and linking
|
||||
idf_build_get_property(build_components BUILD_COMPONENTS)
|
||||
if(nvs_flash IN_LIST build_components)
|
||||
target_sources(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/psa_crypto_storage/esp_psa_its.c")
|
||||
idf_component_get_property(nvs_flash_lib nvs_flash COMPONENT_LIB)
|
||||
target_link_libraries(tfpsacrypto PRIVATE ${nvs_flash_lib})
|
||||
target_compile_definitions(tfpsacrypto PRIVATE ESP_PSA_ITS_AVAILABLE)
|
||||
endif()
|
||||
endif()
|
||||
endif()
|
||||
endif()
|
||||
|
||||
if(CONFIG_MBEDTLS_DYNAMIC_BUFFER)
|
||||
set(mbedtls_target_sources ${mbedtls_target_sources}
|
||||
set(mbedtls_target_sources ${mbedtls_target_sources}
|
||||
"${COMPONENT_DIR}/port/dynamic/esp_mbedtls_dynamic_impl.c"
|
||||
"${COMPONENT_DIR}/port/dynamic/esp_ssl_cli.c"
|
||||
"${COMPONENT_DIR}/port/dynamic/esp_ssl_srv.c"
|
||||
@@ -180,13 +251,13 @@ set(mbedtls_target_sources ${mbedtls_target_sources}
|
||||
endif()
|
||||
|
||||
if(${IDF_TARGET} STREQUAL "linux")
|
||||
set(mbedtls_target_sources ${mbedtls_target_sources} "${COMPONENT_DIR}/port/net_sockets.c")
|
||||
set(mbedtls_target_sources ${mbedtls_target_sources} "${COMPONENT_DIR}/port/net_sockets.c")
|
||||
endif()
|
||||
|
||||
# While updating to MbedTLS release/v3.4.0, building mbedtls/library/psa_crypto.c
|
||||
# clang produces an unreachable-code warning.
|
||||
if(CMAKE_C_COMPILER_ID MATCHES "Clang")
|
||||
target_compile_options(mbedcrypto PRIVATE "-Wno-unreachable-code")
|
||||
target_compile_options(tfpsacrypto PRIVATE "-Wno-unreachable-code")
|
||||
endif()
|
||||
|
||||
# net_sockets.c should only be compiled if BSD socket functions are available.
|
||||
@@ -206,7 +277,8 @@ endif()
|
||||
target_sources(mbedtls PRIVATE ${mbedtls_target_sources})
|
||||
|
||||
if(NOT ${IDF_TARGET} STREQUAL "linux")
|
||||
target_link_libraries(mbedcrypto PRIVATE idf::esp_security)
|
||||
target_link_libraries(tfpsacrypto PRIVATE idf::esp_security)
|
||||
target_link_libraries(builtin PRIVATE idf::esp_security)
|
||||
endif()
|
||||
|
||||
# Choose peripheral type
|
||||
@@ -219,18 +291,25 @@ if(CONFIG_SOC_SHA_SUPPORTED)
|
||||
endif()
|
||||
endif()
|
||||
|
||||
if(SHA_PERIPHERAL_TYPE STREQUAL "core")
|
||||
target_include_directories(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/sha/core/include")
|
||||
if(CONFIG_SOC_AES_SUPPORTED)
|
||||
if(CONFIG_SOC_AES_SUPPORT_DMA)
|
||||
set(AES_PERIPHERAL_TYPE "dma")
|
||||
else()
|
||||
set(AES_PERIPHERAL_TYPE "block")
|
||||
endif()
|
||||
endif()
|
||||
|
||||
if(SHA_PERIPHERAL_TYPE STREQUAL "core")
|
||||
target_include_directories(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/sha/core/include")
|
||||
if(CONFIG_SOC_SHA_GDMA)
|
||||
set(SHA_CORE_SRCS "${COMPONENT_DIR}/port/sha/core/esp_sha_gdma_impl.c")
|
||||
elseif(CONFIG_SOC_SHA_CRYPTO_DMA)
|
||||
set(SHA_CORE_SRCS "${COMPONENT_DIR}/port/sha/core/esp_sha_crypto_dma_impl.c")
|
||||
endif()
|
||||
target_sources(mbedcrypto PRIVATE "${SHA_CORE_SRCS}")
|
||||
target_sources(tfpsacrypto PRIVATE "${SHA_CORE_SRCS}")
|
||||
endif()
|
||||
|
||||
if(CONFIG_SOC_AES_SUPPORT_DMA)
|
||||
if(AES_PERIPHERAL_TYPE STREQUAL "dma")
|
||||
if(NOT CONFIG_SOC_AES_GDMA)
|
||||
set(AES_DMA_SRCS "${COMPONENT_DIR}/port/aes/dma/esp_aes_crypto_dma_impl.c")
|
||||
else()
|
||||
@@ -239,47 +318,66 @@ if(CONFIG_SOC_AES_SUPPORT_DMA)
|
||||
|
||||
list(APPEND AES_DMA_SRCS "${COMPONENT_DIR}/port/aes/dma/esp_aes_dma_core.c")
|
||||
|
||||
target_include_directories(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/aes/dma/include")
|
||||
target_sources(mbedcrypto PRIVATE "${AES_DMA_SRCS}")
|
||||
target_include_directories(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/aes/dma/include")
|
||||
target_sources(tfpsacrypto PRIVATE "${AES_DMA_SRCS}")
|
||||
endif()
|
||||
|
||||
if((SHA_PERIPHERAL_TYPE STREQUAL "core" AND CONFIG_SOC_SHA_SUPPORT_DMA) OR CONFIG_SOC_AES_SUPPORT_DMA)
|
||||
target_link_libraries(mbedcrypto PRIVATE idf::esp_mm)
|
||||
if((SHA_PERIPHERAL_TYPE STREQUAL "core" AND CONFIG_SOC_SHA_SUPPORT_DMA) OR AES_PERIPHERAL_TYPE STREQUAL "dma")
|
||||
target_link_libraries(tfpsacrypto PRIVATE idf::esp_mm)
|
||||
target_link_libraries(builtin PRIVATE idf::esp_mm)
|
||||
if(CONFIG_SOC_SHA_GDMA OR CONFIG_SOC_AES_GDMA)
|
||||
target_sources(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/crypto_shared_gdma/esp_crypto_shared_gdma.c")
|
||||
if(CONFIG_SOC_AXI_DMA_EXT_MEM_ENC_ALIGNMENT)
|
||||
target_link_libraries(tfpsacrypto PRIVATE idf::bootloader_support)
|
||||
target_link_libraries(builtin PRIVATE idf::bootloader_support)
|
||||
endif()
|
||||
target_sources(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/crypto_shared_gdma/esp_crypto_shared_gdma.c")
|
||||
endif()
|
||||
endif()
|
||||
|
||||
if(NOT ${IDF_TARGET} STREQUAL "linux")
|
||||
target_sources(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/esp_hardware.c")
|
||||
target_sources(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/esp_hardware.c")
|
||||
endif()
|
||||
target_sources(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/esp_mem.c"
|
||||
"${COMPONENT_DIR}/port/esp_timing.c"
|
||||
target_sources(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/esp_mem.c"
|
||||
# "${COMPONENT_DIR}/port/esp_timing.c"
|
||||
)
|
||||
|
||||
if(CONFIG_SOC_AES_SUPPORTED)
|
||||
target_include_directories(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/aes/include")
|
||||
target_sources(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/aes/esp_aes_xts.c"
|
||||
target_include_directories(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/aes/include")
|
||||
target_sources(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/aes/esp_aes_xts.c"
|
||||
"${COMPONENT_DIR}/port/aes/esp_aes_common.c"
|
||||
"${COMPONENT_DIR}/port/aes/esp_aes.c"
|
||||
)
|
||||
endif()
|
||||
|
||||
if(CONFIG_SOC_SHA_SUPPORTED)
|
||||
target_sources(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/sha/esp_sha.c"
|
||||
"${COMPONENT_DIR}/port/sha/${SHA_PERIPHERAL_TYPE}/sha.c"
|
||||
if(CONFIG_MBEDTLS_HARDWARE_SHA)
|
||||
target_compile_definitions(tfpsacrypto PRIVATE ESP_SHA_DRIVER_ENABLED)
|
||||
target_sources(tfpsacrypto PRIVATE
|
||||
"${COMPONENT_DIR}/port/psa_driver/esp_sha/psa_crypto_driver_esp_sha.c"
|
||||
"${COMPONENT_DIR}/port/psa_driver/esp_sha/${SHA_PERIPHERAL_TYPE}/psa_crypto_driver_esp_sha256.c"
|
||||
"${COMPONENT_DIR}/port/psa_driver/esp_sha/${SHA_PERIPHERAL_TYPE}/psa_crypto_driver_esp_sha512.c"
|
||||
|
||||
"${COMPONENT_DIR}/port/sha/esp_sha.c")
|
||||
endif()
|
||||
target_sources(tfpsacrypto PRIVATE
|
||||
"${COMPONENT_DIR}/port/psa_driver/esp_sha/${SHA_PERIPHERAL_TYPE}/psa_crypto_driver_esp_sha1.c"
|
||||
"${COMPONENT_DIR}/port/sha/${SHA_PERIPHERAL_TYPE}/sha.c"
|
||||
)
|
||||
endif()
|
||||
|
||||
if(CONFIG_SOC_DIG_SIGN_SUPPORTED)
|
||||
target_sources(mbedcrypto PRIVATE
|
||||
target_sources(tfpsacrypto PRIVATE
|
||||
"${COMPONENT_DIR}/port/esp_ds/esp_rsa_sign_alt.c"
|
||||
"${COMPONENT_DIR}/port/esp_ds/esp_rsa_dec_alt.c"
|
||||
"${COMPONENT_DIR}/port/esp_ds/esp_ds_common.c")
|
||||
endif()
|
||||
# # CONFIG_ESP_TLS_USE_DS_PERIPHERAL can be enabled only for the supported targets.
|
||||
if(CONFIG_ESP_TLS_USE_DS_PERIPHERAL)
|
||||
target_sources(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/esp_ds/esp_rsa_sign_alt.c")
|
||||
endif()
|
||||
|
||||
if(CONFIG_SOC_HMAC_SUPPORTED)
|
||||
target_sources(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/esp_hmac_pbkdf2.c")
|
||||
target_sources(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/esp_hmac_pbkdf2.c")
|
||||
endif()
|
||||
|
||||
# Note: some mbedTLS hardware acceleration can be enabled/disabled by config.
|
||||
@@ -290,28 +388,36 @@ endif()
|
||||
# The other port-specific files don't override internal mbedTLS functions, they just add new functions.
|
||||
|
||||
if(CONFIG_MBEDTLS_HARDWARE_MPI)
|
||||
target_sources(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/bignum/esp_bignum.c"
|
||||
target_sources(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/bignum/esp_bignum.c"
|
||||
"${COMPONENT_DIR}/port/bignum/bignum_alt.c")
|
||||
endif()
|
||||
|
||||
if(CONFIG_MBEDTLS_HARDWARE_SHA)
|
||||
target_sources(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/sha/${SHA_PERIPHERAL_TYPE}/esp_sha1.c"
|
||||
"${COMPONENT_DIR}/port/sha/${SHA_PERIPHERAL_TYPE}/esp_sha256.c"
|
||||
"${COMPONENT_DIR}/port/sha/${SHA_PERIPHERAL_TYPE}/esp_sha512.c"
|
||||
)
|
||||
endif()
|
||||
|
||||
if(CONFIG_MBEDTLS_HARDWARE_GCM OR CONFIG_MBEDTLS_HARDWARE_AES)
|
||||
target_sources(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/aes/esp_aes_gcm.c")
|
||||
target_compile_definitions(tfpsacrypto PRIVATE ESP_AES_DRIVER_ENABLED)
|
||||
target_include_directories(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/include/aes")
|
||||
target_sources(tfpsacrypto PRIVATE
|
||||
"${COMPONENT_DIR}/port/psa_driver/esp_aes/psa_crypto_driver_esp_aes.c"
|
||||
)
|
||||
if(CONFIG_MBEDTLS_HARDWARE_SHA)
|
||||
target_sources(tfpsacrypto PRIVATE
|
||||
"${COMPONENT_DIR}/port/psa_driver/esp_aes/psa_crypto_driver_esp_cmac.c"
|
||||
)
|
||||
endif()
|
||||
if(CONFIG_SOC_AES_SUPPORT_GCM)
|
||||
target_sources(tfpsacrypto PRIVATE "$ENV{IDF_PATH}/components/mbedtls/port/aes/esp_aes_gcm.c"
|
||||
"${COMPONENT_DIR}/port/psa_driver/esp_aes/psa_crypto_driver_esp_aes_gcm.c")
|
||||
endif()
|
||||
endif()
|
||||
|
||||
if(CONFIG_MBEDTLS_HARDWARE_ECC)
|
||||
target_sources(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/ecc/esp_ecc.c"
|
||||
target_sources(builtin PRIVATE "${COMPONENT_DIR}/port/ecc/esp_ecc.c"
|
||||
"${COMPONENT_DIR}/port/ecc/ecc_alt.c")
|
||||
include_directories("${COMPONENT_DIR}/tf-psa-crypto/drivers/builtin/include/mbedtls")
|
||||
endif()
|
||||
|
||||
if(CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN OR CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY OR CONFIG_MBEDTLS_TEE_SEC_STG_ECDSA_SIGN)
|
||||
target_sources(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/ecdsa/ecdsa_alt.c")
|
||||
if(CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN OR
|
||||
CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY OR CONFIG_MBEDTLS_TEE_SEC_STG_ECDSA_SIGN)
|
||||
target_sources(builtin PRIVATE "${COMPONENT_DIR}/port/ecdsa/ecdsa_alt.c")
|
||||
|
||||
set(WRAP_FUNCTIONS_SIGN
|
||||
mbedtls_ecdsa_sign
|
||||
@@ -343,35 +449,37 @@ if(CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN OR CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY OR
|
||||
endif()
|
||||
|
||||
if(CONFIG_MBEDTLS_TEE_SEC_STG_ECDSA_SIGN)
|
||||
target_link_libraries(mbedcrypto PRIVATE idf::tee_sec_storage)
|
||||
target_link_libraries(builtin PRIVATE idf::tee_sec_storage)
|
||||
endif()
|
||||
endif()
|
||||
|
||||
if(CONFIG_MBEDTLS_ROM_MD5)
|
||||
target_sources(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/md/esp_md.c")
|
||||
# if(CONFIG_MBEDTLS_ROM_MD5)
|
||||
# target_sources(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/md/esp_md.c")
|
||||
# endif()
|
||||
|
||||
# if(CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL)
|
||||
# target_sources(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/mbedtls_rom/mbedtls_rom_osi.c")
|
||||
# target_link_libraries(${COMPONENT_LIB} PRIVATE "-u mbedtls_rom_osi_functions_init")
|
||||
# endif()
|
||||
|
||||
if(CONFIG_COMPILER_STATIC_ANALYZER AND CMAKE_C_COMPILER_ID STREQUAL "GNU")
|
||||
target_compile_options(${COMPONENT_LIB} PRIVATE "-fno-analyzer")
|
||||
target_compile_options(tfpsacrypto PRIVATE "-fno-analyzer")
|
||||
endif()
|
||||
|
||||
if(CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL)
|
||||
target_sources(mbedcrypto PRIVATE "${COMPONENT_DIR}/port/mbedtls_rom/mbedtls_rom_osi.c")
|
||||
target_link_libraries(${COMPONENT_LIB} PRIVATE "-u mbedtls_rom_osi_functions_init")
|
||||
# If linkage_type is PUBLIC, use PRIVATE while setting compiler optimization flags
|
||||
# as we don't want the optimization flags to modify other targets
|
||||
if(linkage_type STREQUAL "PUBLIC")
|
||||
set(compiler_linkage_type PRIVATE)
|
||||
else()
|
||||
set(compiler_linkage_type ${linkage_type})
|
||||
endif()
|
||||
|
||||
foreach(target ${mbedtls_targets})
|
||||
target_compile_definitions(${target} PUBLIC -DMBEDTLS_CONFIG_FILE="mbedtls/esp_config.h")
|
||||
if(CONFIG_COMPILER_STATIC_ANALYZER AND CMAKE_C_COMPILER_ID STREQUAL "GNU") # TODO IDF-10087
|
||||
target_compile_options(${target} PRIVATE "-fno-analyzer")
|
||||
endif()
|
||||
if(CONFIG_MBEDTLS_COMPILER_OPTIMIZATION_SIZE)
|
||||
target_compile_options(${target} PRIVATE "-Os")
|
||||
elseif(CONFIG_MBEDTLS_COMPILER_OPTIMIZATION_PERF)
|
||||
target_compile_options(${target} PRIVATE "-O2")
|
||||
endif()
|
||||
endforeach()
|
||||
|
||||
if(CONFIG_MBEDTLS_COMPILER_OPTIMIZATION_SIZE)
|
||||
target_compile_options(${COMPONENT_LIB} PRIVATE "-Os")
|
||||
message(STATUS "Linkage type is ${linkage_type}")
|
||||
target_compile_options(${COMPONENT_LIB} ${compiler_linkage_type} "-Os")
|
||||
elseif(CONFIG_MBEDTLS_COMPILER_OPTIMIZATION_PERF)
|
||||
target_compile_options(${COMPONENT_LIB} PRIVATE "-O2")
|
||||
target_compile_options(${COMPONENT_LIB} ${compiler_linkage_type} "-O2")
|
||||
endif()
|
||||
|
||||
if(CONFIG_MBEDTLS_DYNAMIC_BUFFER)
|
||||
@@ -392,40 +500,121 @@ if(CONFIG_MBEDTLS_DYNAMIC_BUFFER)
|
||||
endforeach()
|
||||
endif()
|
||||
|
||||
set_property(TARGET mbedcrypto APPEND PROPERTY LINK_INTERFACE_LIBRARIES mbedtls)
|
||||
# set_property(TARGET mbedcrypto APPEND PROPERTY LINK_INTERFACE_LIBRARIES mbedtls)
|
||||
|
||||
if(CONFIG_PM_ENABLE)
|
||||
target_link_libraries(mbedcrypto PRIVATE idf::esp_pm)
|
||||
target_link_libraries(tfpsacrypto PRIVATE idf::esp_pm)
|
||||
endif()
|
||||
|
||||
if(CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN OR CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY)
|
||||
target_link_libraries(mbedcrypto PRIVATE idf::efuse)
|
||||
target_link_libraries(builtin PRIVATE idf::efuse)
|
||||
endif()
|
||||
|
||||
target_link_libraries(${COMPONENT_LIB} ${linkage_type} ${mbedtls_targets})
|
||||
|
||||
# Ensure PSA crypto initialization is included in the build
|
||||
target_link_libraries(${COMPONENT_LIB} ${linkage_type} "-u mbedtls_psa_crypto_init_include_impl")
|
||||
|
||||
if(CONFIG_ESP_TLS_USE_DS_PERIPHERAL)
|
||||
# The linker seems to be unable to resolve all the dependencies without increasing this
|
||||
set_property(TARGET mbedcrypto APPEND PROPERTY LINK_INTERFACE_MULTIPLICITY 6)
|
||||
if(NOT ${IDF_TARGET} STREQUAL "linux")
|
||||
target_link_libraries(${COMPONENT_LIB} ${linkage_type} "-u mbedtls_psa_crypto_init_include_impl")
|
||||
endif()
|
||||
|
||||
# Additional optional dependencies for the mbedcrypto library
|
||||
function(mbedcrypto_optional_deps component_name)
|
||||
function(builtin_optional_deps component_name)
|
||||
idf_build_get_property(components BUILD_COMPONENTS)
|
||||
if(${component_name} IN_LIST components)
|
||||
idf_component_get_property(lib_name ${component_name} COMPONENT_LIB)
|
||||
target_link_libraries(mbedcrypto PRIVATE ${lib_name})
|
||||
target_link_libraries(builtin PRIVATE ${lib_name})
|
||||
endif()
|
||||
endfunction()
|
||||
|
||||
if(CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN_CONSTANT_TIME_CM)
|
||||
mbedcrypto_optional_deps(esp_timer idf::esp_timer)
|
||||
builtin_optional_deps(esp_timer idf::esp_timer)
|
||||
endif()
|
||||
|
||||
# Link esp-cryptoauthlib to mbedtls
|
||||
if(CONFIG_ATCA_MBEDTLS_ECDSA)
|
||||
mbedcrypto_optional_deps(espressif__esp-cryptoauthlib esp-cryptoauthlib)
|
||||
# # Link esp-cryptoauthlib to mbedtls
|
||||
# if(CONFIG_ATCA_MBEDTLS_ECDSA)
|
||||
# mbedcrypto_optional_deps(espressif__esp-cryptoauthlib esp-cryptoauthlib)
|
||||
# endif()
|
||||
|
||||
# Apply -fno-analyzer to ALL mbedTLS targets at the very end when all targets are created
|
||||
if(CONFIG_COMPILER_STATIC_ANALYZER AND CMAKE_C_COMPILER_ID STREQUAL "GNU")
|
||||
message(STATUS "Applying -fno-analyzer to all mbedTLS targets...")
|
||||
|
||||
# Get all targets from all directories
|
||||
get_property(
|
||||
all_mbedtls_targets DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/mbedtls PROPERTY BUILDSYSTEM_TARGETS
|
||||
)
|
||||
get_property(
|
||||
drivers_targets DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/mbedtls/tf-psa-crypto/drivers PROPERTY BUILDSYSTEM_TARGETS
|
||||
)
|
||||
|
||||
message(STATUS "Found mbedtls targets: ${all_mbedtls_targets}")
|
||||
message(STATUS "Found drivers targets: ${drivers_targets}")
|
||||
|
||||
# Get targets from nested driver subdirectories
|
||||
foreach(subdir IN ITEMS builtin everest p256-m)
|
||||
if(EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/mbedtls/tf-psa-crypto/drivers/${subdir})
|
||||
get_property(
|
||||
subdir_targets DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/mbedtls/tf-psa-crypto/drivers/${subdir}
|
||||
PROPERTY BUILDSYSTEM_TARGETS
|
||||
)
|
||||
message(STATUS "Found ${subdir} targets: ${subdir_targets}")
|
||||
list(APPEND drivers_targets ${subdir_targets})
|
||||
endif()
|
||||
endforeach()
|
||||
|
||||
# Combine all target lists
|
||||
set(all_targets ${all_mbedtls_targets} ${drivers_targets})
|
||||
message(STATUS "All combined targets: ${all_targets}")
|
||||
|
||||
# Apply -fno-analyzer to each target
|
||||
foreach(target ${all_targets})
|
||||
if(TARGET ${target})
|
||||
get_target_property(target_type ${target} TYPE)
|
||||
if(target_type STREQUAL "STATIC_LIBRARY" OR
|
||||
target_type STREQUAL "SHARED_LIBRARY" OR
|
||||
target_type STREQUAL "MODULE_LIBRARY" OR
|
||||
target_type STREQUAL "OBJECT_LIBRARY" OR
|
||||
target_type STREQUAL "EXECUTABLE")
|
||||
message(STATUS "Applying -fno-analyzer to target: ${target}")
|
||||
target_compile_options(${target} PRIVATE "-fno-analyzer")
|
||||
endif()
|
||||
endif()
|
||||
endforeach()
|
||||
|
||||
# Also check for any targets that might have been missed by using global target list
|
||||
get_property(global_targets GLOBAL PROPERTY TARGETS)
|
||||
set(mbedtls_global_targets "")
|
||||
foreach(target ${global_targets})
|
||||
if(TARGET ${target})
|
||||
get_target_property(target_source_dir ${target} SOURCE_DIR)
|
||||
if(target_source_dir)
|
||||
# Check if target is from mbedtls directory or has mbedtls-related names
|
||||
string(FIND "${target_source_dir}" "mbedtls" pos)
|
||||
string(FIND "${target}" "mbedtls" name_pos)
|
||||
string(FIND "${target}" "tfpsacrypto" tfpsa_pos)
|
||||
# string(FIND "${target}" "everest" everest_pos)
|
||||
# string(FIND "${target}" "p256m" p256m_pos)
|
||||
string(FIND "${target}" "builtin" builtin_pos)
|
||||
if(pos GREATER -1 OR name_pos GREATER -1 OR tfpsa_pos GREATER -1 OR builtin_pos GREATER -1)
|
||||
list(APPEND mbedtls_global_targets ${target})
|
||||
get_target_property(target_type ${target} TYPE)
|
||||
# Skip ALIAS targets as they don't have compile options
|
||||
if(NOT target_type STREQUAL "ALIAS" AND
|
||||
(target_type STREQUAL "STATIC_LIBRARY" OR
|
||||
target_type STREQUAL "SHARED_LIBRARY" OR
|
||||
target_type STREQUAL "MODULE_LIBRARY" OR
|
||||
target_type STREQUAL "OBJECT_LIBRARY" OR
|
||||
target_type STREQUAL "EXECUTABLE"))
|
||||
# Check if -fno-analyzer was already applied
|
||||
get_target_property(compile_options ${target} COMPILE_OPTIONS)
|
||||
if(NOT compile_options OR NOT "-fno-analyzer" IN_LIST compile_options)
|
||||
message(STATUS "Applying -fno-analyzer to missed target: ${target}")
|
||||
target_compile_options(${target} PRIVATE "-fno-analyzer")
|
||||
endif()
|
||||
endif()
|
||||
endif()
|
||||
endif()
|
||||
endif()
|
||||
endforeach()
|
||||
message(STATUS "All mbedtls-related global targets: ${mbedtls_global_targets}")
|
||||
endif()
|
||||
|
||||
Reference in New Issue
Block a user