mbedtls: add Kconfig symbol CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS

Adding the Kconfig symbol CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS
to allow Mbed TLS's PSA Crypto core to use static key buffers
to store key's material. This helps reducing heap memory
usage and, potentially, it also discard code implementing
heap memory management if there's no other module in the build
that makes use of it.

Signed-off-by: Valerio Setti <[email protected]>

Author: valeriosetti

doc/releases/release-notes-4.1.rst

@@ -250,6 +250,12 @@ Libraries / Subsystems
 
 * Crypto
 
+  * The Kconfig symbol :kconfig:option:`CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS` was
+    added to allow Mbed TLS to use statically allocated buffers to store key material
+    in its PSA Crypto core instead of heap-allocated ones. This can help reduce
+    (or remove, if no other component makes use of it) heap memory requirements
+    from the final application.
+
 * CMSIS-NN
 
 * FPGA

modules/mbedtls/Kconfig.tls-generic

@@ -554,9 +554,10 @@ config MBEDTLS_LMS
 	depends on MBEDTLS_SHA256
 	select PSA_WANT_ALG_SHA_256
 
+if MBEDTLS_PSA_CRYPTO_C
+
 config MBEDTLS_PSA_P256M_DRIVER_ENABLED
 	bool "P256-M driver"
-	depends on MBEDTLS_PSA_CRYPTO_C
 	imply PSA_WANT_ALG_SHA_256
 	help
 	  Enable support for the optimized sofware implementation of the secp256r1
@@ -570,6 +571,22 @@ config MBEDTLS_PSA_P256M_DRIVER_RAW
 	  Warning: Usage of this Kconfig option is prohibited in Zephyr's codebase.
 	           Users can enable it in case of very memory-constrained devices, but be aware that the p256-m interface is absolutely not guaranted to remain stable over time.
 
+config MBEDTLS_PSA_STATIC_KEY_SLOTS
+	bool "Use statically allocated key buffers to store key material"
+	default y if !MBEDTLS_ENABLE_HEAP
+	help
+	  By default Mbed TLS's PSA Crypto core uses heap memory to store the
+	  key material for each key slot. This might impose an undesired
+	  requirement to support heap memory and its management code, affecting
+	  RAM and ROM footprints at the same time.
+	  Enabling this symbol causes Mbed TLS to pre-allocate all the key slot
+	  buffers that are used to store the key material at build time, thus
+	  removing the need for heap memory. Each buffer will be sized to
+	  contain the largest asymmetric/symmetric key type enabled in the build
+	  through PSA_WANT symbols.
+
+endif # MBEDTLS_PSA_CRYPTO_C
+
 config MBEDTLS_SSL_DTLS_CONNECTION_ID
 	bool "DTLS Connection ID extension"
 	depends on MBEDTLS_DTLS

modules/mbedtls/configs/config-tls-generic.h

@@ -494,6 +494,10 @@
 
 #endif /* CONFIG_MBEDTLS_PSA_CRYPTO_C */
 
+#if defined(CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS)
+#define MBEDTLS_PSA_STATIC_KEY_SLOTS
+#endif
+
 #if defined(CONFIG_MBEDTLS_USE_PSA_CRYPTO)
 #define MBEDTLS_USE_PSA_CRYPTO
 #endif

tests/crypto/secp256r1/mbedtls.conf

@@ -1,6 +1,7 @@
 CONFIG_MBEDTLS=y
 CONFIG_MBEDTLS_PSA_CRYPTO_C=y
 CONFIG_MBEDTLS_PSA_P256M_DRIVER_ENABLED=y
+CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS=y
 
 CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT=y
 CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE=y