Skip to content

Commit 17ca6ec

Browse files
valeriosettiVge0rge
valeriosetti
authored and
Vge0rge
committed
[nrf fromtree] modules: mbedtls: add new helper Kconfig symbol PSA_CRYPTO
The goal of new Kconfig PSA_CRYPTO_PROVIDER is to automatically enable any of the PSA Crypto API provider available for the platform without having the user to manually pick the proper one. This provider can be either TF-M, if that's enabled in the build, or Mbed TLS otherwise. PSA_CRYPTO_PROVIDER simplifies also modules/subsystem Kconfigs removing blocks as: select MBEDTLS if !BUILD_WITH_TFM select MBEDTLS_PSA_CRYPTO_C if !BUILD_WITH_TFM Kconfig PSA_CRYPTO_PROVIDER_CUSTOM is also added to allow the end user to add a custom implementation of PSA Crypto API instead of TF-M or Mbed TLS ones. Signed-off-by: Valerio Setti <[email protected]> (cherry picked from commit 1bc2db5)
1 parent b4fed99 commit 17ca6ec

File tree

11 files changed

+43
-25
lines changed

11 files changed

+43
-25
lines changed

‎drivers/bluetooth/hci/Kconfig‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -158,8 +158,7 @@ config BT_SILABS_EFR32
158158
depends on ZEPHYR_HAL_SILABS_MODULE_BLOBS || BUILD_ONLY_NO_BLOBS
159159
depends on !PM || SOC_GECKO_PM_BACKEND_PMGR
160160
select SOC_GECKO_USE_RAIL
161-
select MBEDTLS
162-
select MBEDTLS_PSA_CRYPTO_C
161+
select PSA_CRYPTO
163162
select HAS_BT_CTLR
164163
select BT_CTLR_PHY_UPDATE_SUPPORT
165164
select BT_CTLR_PER_INIT_FEAT_XCHG_SUPPORT

‎modules/hostap/Kconfig‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,7 @@ endchoice
204204

205205
config WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA
206206
bool "Crypto Platform Secure Architecture support for WiFi"
207-
imply MBEDTLS_PSA_CRYPTO_C
207+
select PSA_CRYPTO
208208
select MBEDTLS_USE_PSA_CRYPTO
209209
select PSA_WANT_ALG_ECDH
210210
select PSA_WANT_ALG_HMAC

‎modules/mbedtls/Kconfig.psa.logic‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,37 @@
11
# Copyright (c) 2024 BayLibre SAS
22
# SPDX-License-Identifier: Apache-2.0
33

4-
# This file extends Kconfig.psa (which is automatically generated) by adding
5-
# some logic between PSA_WANT symbols.
4+
config PSA_CRYPTO
5+
bool "PSA Crypto API"
6+
help
7+
Enable a PSA Crypto API provider in the build. If TF-M is enabled then
8+
it will be used for this scope, otherwise Mbed TLS will be used.
9+
PSA_CRYPTO_PROVIDER_CUSTOM can be selected to use an out-of-tree
10+
implementation.
11+
12+
choice PSA_CRYPTO_PROVIDER
13+
prompt "PSA Crypto API provider"
14+
depends on PSA_CRYPTO
15+
16+
config PSA_CRYPTO_PROVIDER_TFM
17+
bool "Use TF-M"
18+
depends on BUILD_WITH_TFM
19+
select TFM_PARTITION_CRYPTO
20+
21+
config PSA_CRYPTO_PROVIDER_MBEDTLS
22+
bool "Use Mbed TLS"
23+
depends on !BUILD_WITH_TFM
24+
select MBEDTLS
25+
select MBEDTLS_PSA_CRYPTO_C
26+
27+
config PSA_CRYPTO_PROVIDER_CUSTOM
28+
bool "Use an out-of-tree library"
29+
depends on !BUILD_WITH_TFM
30+
31+
endchoice # PSA_CRYPTO_PROVIDER
32+
33+
# The following section extends Kconfig.psa.auto (which is automatically
34+
# generated) by adding some logic between PSA_WANT symbols.
635

736
config PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC
837
bool

‎modules/uoscore-uedhoc/Kconfig‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ menuconfig UOSCORE
55
bool "UOSCORE library"
66
depends on ZCBOR
77
depends on ZCBOR_CANONICAL
8-
depends on MBEDTLS
98
select UOSCORE_UEDHOC_CRYPTO_COMMON
109

1110
help
@@ -22,7 +21,6 @@ menuconfig UEDHOC
2221
bool "UEDHOC library"
2322
depends on ZCBOR
2423
depends on ZCBOR_CANONICAL
25-
depends on MBEDTLS
2624
select UOSCORE_UEDHOC_CRYPTO_COMMON
2725
help
2826
This option enables the UEDHOC library.
@@ -38,7 +36,7 @@ if UOSCORE || UEDHOC
3836

3937
config UOSCORE_UEDHOC_CRYPTO_COMMON
4038
bool
41-
imply MBEDTLS_PSA_CRYPTO_C if !BUILD_WITH_TFM
39+
select PSA_CRYPTO
4240
select PSA_WANT_ALG_ECDH
4341
select PSA_WANT_ALG_ECDSA
4442
select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT

‎samples/net/sockets/http_server/Kconfig‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ config NET_SAMPLE_HTTP_SERVER_SERVICE_PORT
1717
config NET_SAMPLE_HTTPS_SERVICE
1818
bool "Enable https service"
1919
depends on NET_SOCKETS_SOCKOPT_TLS || TLS_CREDENTIALS
20-
imply MBEDTLS_PSA_CRYPTO_C if !BUILD_WITH_TFM
20+
select PSA_CRYPTO
2121

2222
if NET_SAMPLE_HTTPS_SERVICE
2323

‎samples/subsys/mgmt/updatehub/overlay-psa.conf‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,2 @@
11
CONFIG_FLASH_AREA_CHECK_INTEGRITY_PSA=y
2-
CONFIG_MBEDTLS=y
3-
CONFIG_MBEDTLS_PSA_CRYPTO_C=y
2+
CONFIG_PSA_CRYPTO=y

‎subsys/bluetooth/crypto/Kconfig‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,7 @@
33

44
config BT_CRYPTO
55
bool
6-
select MBEDTLS if !BUILD_WITH_TFM
7-
select MBEDTLS_PSA_CRYPTO_C if !BUILD_WITH_TFM
6+
select PSA_CRYPTO
87
select PSA_WANT_KEY_TYPE_AES
98
select PSA_WANT_ALG_CMAC
109
select PSA_WANT_ALG_ECB_NO_PADDING

‎subsys/bluetooth/host/Kconfig‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -200,8 +200,7 @@ config BT_BUF_EVT_DISCARDABLE_COUNT
200200
config BT_HOST_CRYPTO
201201
bool "Use crypto functionality implemented in the Bluetooth host"
202202
default y if !BT_CTLR_CRYPTO
203-
select MBEDTLS if !BUILD_WITH_TFM
204-
select MBEDTLS_PSA_CRYPTO_C if !BUILD_WITH_TFM
203+
select PSA_CRYPTO
205204
select PSA_WANT_KEY_TYPE_AES
206205
select PSA_WANT_ALG_ECB_NO_PADDING
207206
help
@@ -1041,8 +1040,7 @@ endif # BT_DF
10411040

10421041
config BT_ECC
10431042
bool
1044-
select MBEDTLS if !BUILD_WITH_TFM
1045-
select MBEDTLS_PSA_CRYPTO_C if !BUILD_WITH_TFM
1043+
select PSA_CRYPTO
10461044
select PSA_WANT_ALG_ECDH
10471045
select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE
10481046
select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT

‎subsys/jwt/Kconfig‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,17 +28,15 @@ config JWT_SIGN_RSA_LEGACY
2828

2929
config JWT_SIGN_RSA_PSA
3030
bool "Use RSA signature (RS-256). Use PSA Crypto API."
31-
select MBEDTLS if !BUILD_WITH_TFM
32-
select MBEDTLS_PSA_CRYPTO_C if !BUILD_WITH_TFM
31+
select PSA_CRYPTO
3332
select PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
3433
select PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT
3534
select PSA_WANT_ALG_RSA_PKCS1V15_SIGN
3635
select PSA_WANT_ALG_SHA_256
3736

3837
config JWT_SIGN_ECDSA_PSA
3938
bool "Use ECDSA signature (ES-256). Use PSA Crypto API."
40-
select MBEDTLS if !BUILD_WITH_TFM
41-
select MBEDTLS_PSA_CRYPTO_C if !BUILD_WITH_TFM
39+
select PSA_CRYPTO
4240
select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT
4341
select PSA_WANT_ALG_ECDSA
4442
select PSA_WANT_ECC_SECP_R1_256

‎tests/bsim/bluetooth/host/gatt/caching/psa_overlay.conf‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,2 @@
1-
CONFIG_MBEDTLS=y
2-
CONFIG_MBEDTLS_PSA_CRYPTO_C=y
1+
CONFIG_PSA_CRYPTO=y
32
CONFIG_PSA_CRYPTO_ENABLE_ALL=y

0 commit comments

Comments
 (0)