[nrf fromtree] Bluetooth: Mesh: use secure storage in ble mesh

alxelax · tomi-font · commit 455083c0dfad · 2025-02-14T16:43:45.000+02:00
Commit: - adds dependency of the mbedtls psa usage on secure storage - removes PSA ITS emulator and enables usage of the secure storage in ble mesh bsim tests - enables secure storage in all ble mesh and related samples Signed-off-by: Aleksandr Khromykh <aleksandr.khromykh@nordicsemi.no> (cherry picked from commit 967b096) Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
diff --git a/modules/mbedtls/configs/config-tls-generic.h b/modules/mbedtls/configs/config-tls-generic.h
@@ -482,12 +482,6 @@
 #define MBEDTLS_PSA_P256M_DRIVER_ENABLED
 #endif
 
-#if defined(CONFIG_ARCH_POSIX) && !defined(CONFIG_PICOLIBC) && !defined(CONFIG_SECURE_STORAGE)
-#define MBEDTLS_PSA_ITS_FILE_C
-#define MBEDTLS_PSA_CRYPTO_STORAGE_C
-#define MBEDTLS_FS_IO
-#endif
-
 #if defined(CONFIG_SECURE_STORAGE)
 #define MBEDTLS_PSA_CRYPTO_STORAGE_C
 #endif
diff --git a/samples/bluetooth/mesh/boards/nrf5340dk_nrf5340_cpuapp_ns.conf b/samples/bluetooth/mesh/boards/nrf5340dk_nrf5340_cpuapp_ns.conf
@@ -0,0 +1 @@
+CONFIG_SECURE_STORAGE=n
diff --git a/samples/bluetooth/mesh/prj.conf b/samples/bluetooth/mesh/prj.conf
@@ -5,6 +5,7 @@ CONFIG_FLASH=y
 CONFIG_FLASH_MAP=y
 CONFIG_NVS=y
 CONFIG_SETTINGS=y
+CONFIG_SECURE_STORAGE=y
 CONFIG_HWINFO=y
 
 CONFIG_BT=y
diff --git a/samples/bluetooth/mesh_demo/boards/nrf5340dk_nrf5340_cpuapp_ns.conf b/samples/bluetooth/mesh_demo/boards/nrf5340dk_nrf5340_cpuapp_ns.conf
@@ -0,0 +1 @@
+CONFIG_SECURE_STORAGE=n
diff --git a/samples/bluetooth/mesh_demo/prj.conf b/samples/bluetooth/mesh_demo/prj.conf
@@ -31,6 +31,7 @@ CONFIG_FLASH_MAP=y
 CONFIG_NVS=y
 CONFIG_SETTINGS=y
 CONFIG_BT_MESH_RPL_STORE_TIMEOUT=600
+CONFIG_SECURE_STORAGE=y
 
 # Limit the number of key slots in PSA Crypto core to reduce
 # RAM footprint
diff --git a/samples/bluetooth/mesh_provisioner/boards/nrf5340dk_nrf5340_cpuapp_ns.conf b/samples/bluetooth/mesh_provisioner/boards/nrf5340dk_nrf5340_cpuapp_ns.conf
@@ -0,0 +1 @@
+CONFIG_SECURE_STORAGE=n
diff --git a/samples/bluetooth/mesh_provisioner/prj.conf b/samples/bluetooth/mesh_provisioner/prj.conf
@@ -45,6 +45,7 @@ CONFIG_FLASH_MAP=y
 CONFIG_NVS=y
 CONFIG_SETTINGS=y
 CONFIG_BT_MESH_RPL_STORE_TIMEOUT=600
+CONFIG_SECURE_STORAGE=y
 
 #CONFIG_BT_MESH_LOG_LEVEL_DBG=y
 #CONFIG_BT_MESH_SETTINGS_LOG_LEVEL_DBG=y
diff --git a/samples/boards/nordic/mesh/onoff-app/prj.conf b/samples/boards/nordic/mesh/onoff-app/prj.conf
@@ -9,6 +9,8 @@ CONFIG_FLASH=y
 CONFIG_FLASH_MAP=y
 CONFIG_NVS=y
 CONFIG_SETTINGS=y
+CONFIG_SECURE_STORAGE=y
+
 CONFIG_BT_MESH_RPL_STORE_TIMEOUT=600
 
 CONFIG_BOOT_BANNER=y
diff --git a/samples/boards/nordic/mesh/onoff_level_lighting_vnd_app/prj.conf b/samples/boards/nordic/mesh/onoff_level_lighting_vnd_app/prj.conf
@@ -7,6 +7,7 @@ CONFIG_FLASH=y
 CONFIG_FLASH_MAP=y
 CONFIG_NVS=y
 CONFIG_SETTINGS=y
+CONFIG_SECURE_STORAGE=y
 
 CONFIG_BT_OBSERVER=y
 CONFIG_BT_BROADCASTER=y
diff --git a/samples/boards/phytec/reel_board/mesh_badge/prj.conf b/samples/boards/phytec/reel_board/mesh_badge/prj.conf
@@ -66,4 +66,5 @@ CONFIG_FLASH=y
 CONFIG_FLASH_MAP=y
 CONFIG_NVS=y
 CONFIG_SETTINGS=y
+CONFIG_SECURE_STORAGE=y
 CONFIG_CBPRINTF_FP_SUPPORT=y
diff --git a/subsys/bluetooth/mesh/Kconfig b/subsys/bluetooth/mesh/Kconfig
@@ -1467,6 +1467,10 @@ config BT_MESH_SOL_ADV_XMIT
 
 endmenu # Proxy
 
+config BT_MESH_SECURE_STORAGE
+	bool
+	depends on SECURE_STORAGE
+
 choice BT_MESH_CRYPTO_LIB
 	prompt "Crypto library:"
 	default BT_MESH_USES_TFM_PSA if BUILD_WITH_TFM
@@ -1506,6 +1510,7 @@ config BT_MESH_USES_MBEDTLS_PSA
 	select PSA_WANT_ALG_SHA_256
 	select PSA_WANT_ALG_ECDH
 	select PSA_WANT_ECC_SECP_R1_256
+	select BT_MESH_SECURE_STORAGE if BT_SETTINGS
 	help
 	  Use Mbed TLS as PSA Crypto API provider. This is useful on platforms
 	  that do not support TF-M.
diff --git a/tests/bluetooth/mesh_shell/prj.conf b/tests/bluetooth/mesh_shell/prj.conf
@@ -14,6 +14,7 @@ CONFIG_FLASH=y
 CONFIG_FLASH_MAP=y
 CONFIG_NVS=y
 CONFIG_SETTINGS=y
+CONFIG_SECURE_STORAGE=y
 
 CONFIG_BT=y
 CONFIG_BT_OBSERVER=y
diff --git a/tests/bsim/bluetooth/mesh/CMakeLists.txt b/tests/bsim/bluetooth/mesh/CMakeLists.txt
@@ -29,7 +29,6 @@ if(CONFIG_SETTINGS)
 if(CONFIG_BT_MESH_USES_MBEDTLS_PSA)
  target_sources(app PRIVATE
   src/distribute_keyid.c
-  src/psa_its_emul.c
  )
 endif()
 
@@ -82,15 +81,3 @@ zephyr_include_directories(
   ${BSIM_COMPONENTS_PATH}/libUtilv1/src/
   ${BSIM_COMPONENTS_PATH}/libPhyComv1/src/
 )
-
-# The mbedTLS PSA ITS is not thread safe.
-# The issue: https://github.com/zephyrproject-rtos/zephyr/issues/59362
-# Also, it isn't possible to use "native" ITS implementation since
-# mbedTLS includes headers that do not exist.
-# This linker option allows linking custom ITS implementation instead of
-# precompiled objects from the mbedTLS library to run it in parallel.
-if(CONFIG_BT_MESH_USES_MBEDTLS_PSA)
-  zephyr_ld_options(
-    ${LINKERFLAGPREFIX},--allow-multiple-definition
-    )
-endif()
diff --git a/tests/bsim/bluetooth/mesh/overlay_pst.conf b/tests/bsim/bluetooth/mesh/overlay_pst.conf
@@ -3,6 +3,7 @@ CONFIG_BT_SETTINGS=y
 CONFIG_FLASH=y
 CONFIG_FLASH_MAP=y
 CONFIG_NVS=y
+CONFIG_SECURE_STORAGE=y
 
 CONFIG_BT_PERIPHERAL=y
 CONFIG_BT_MESH_GATT_PROXY=y
diff --git a/tests/bsim/bluetooth/mesh/src/psa_its_emul.c b/tests/bsim/bluetooth/mesh/src/psa_its_emul.c
