diff --git a/doc/releases/migration-guide-4.1.rst b/doc/releases/migration-guide-4.1.rst index 90dfad9a0e237..8fa72c627cc7c 100644 --- a/doc/releases/migration-guide-4.1.rst +++ b/doc/releases/migration-guide-4.1.rst @@ -36,6 +36,14 @@ Mbed TLS :kconfig:option:`CONFIG_MBEDTLS_PSA_CRYPTO_LEGACY_RNG`. This helps in reducing ROM/RAM footprint of the Mbed TLS library. +* The newly-added Kconfig option :kconfig:option:`CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT` + allows to specify the number of key slots available in the PSA Crypto core. + Previously this value was not explicitly set, so Mbed TLS's default value of + 32 was used. The new Kconfig option defaults to 16 instead in order to find + a reasonable compromise between RAM consumption and most common use cases. + It can be further trimmed down to reduce RAM consumption if the final + application doesn't need that many key slots simultaneously. + Trusted Firmware-M ================== diff --git a/doc/releases/release-notes-4.1.rst b/doc/releases/release-notes-4.1.rst index dff3f100c2c51..0549b4b8c30cb 100644 --- a/doc/releases/release-notes-4.1.rst +++ b/doc/releases/release-notes-4.1.rst @@ -250,6 +250,18 @@ Libraries / Subsystems * Crypto + * The Kconfig symbol :kconfig:option:`CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS` was + added to allow Mbed TLS to use statically allocated buffers to store key material + in its PSA Crypto core instead of heap-allocated ones. This can help reduce + (or remove, if no other component makes use of it) heap memory requirements + from the final application. + + * The Kconfig symbol :kconfig:option:`CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT` was + added to allow selecting the number of key slots available in the Mbed TLS + implementation of the PSA Crypto core. It defaults to 16. Since each + slot consumes RAM memory even if unused, this value can be tweaked in order + to minimize RAM usage. + * CMSIS-NN * FPGA diff --git a/modules/mbedtls/Kconfig.tls-generic b/modules/mbedtls/Kconfig.tls-generic index 779d3b356f826..5c8ac8b569b15 100644 --- a/modules/mbedtls/Kconfig.tls-generic +++ b/modules/mbedtls/Kconfig.tls-generic @@ -554,9 +554,10 @@ config MBEDTLS_LMS depends on MBEDTLS_SHA256 select PSA_WANT_ALG_SHA_256 +if MBEDTLS_PSA_CRYPTO_C + config MBEDTLS_PSA_P256M_DRIVER_ENABLED bool "P256-M driver" - depends on MBEDTLS_PSA_CRYPTO_C imply PSA_WANT_ALG_SHA_256 help Enable support for the optimized sofware implementation of the secp256r1 @@ -570,6 +571,35 @@ config MBEDTLS_PSA_P256M_DRIVER_RAW Warning: Usage of this Kconfig option is prohibited in Zephyr's codebase. Users can enable it in case of very memory-constrained devices, but be aware that the p256-m interface is absolutely not guaranted to remain stable over time. +config MBEDTLS_PSA_STATIC_KEY_SLOTS + bool "Use statically allocated key buffers to store key material" + default y if !MBEDTLS_ENABLE_HEAP + help + By default Mbed TLS's PSA Crypto core uses heap memory to store the + key material for each key slot. This might impose an undesired + requirement to support heap memory and its management code, affecting + RAM and ROM footprints at the same time. + Enabling this symbol causes Mbed TLS to pre-allocate all the key slot + buffers that are used to store the key material at build time, thus + removing the need for heap memory. Each buffer will be sized to + contain the largest asymmetric/symmetric key type enabled in the build + through PSA_WANT symbols. + +config MBEDTLS_PSA_KEY_SLOT_COUNT + int "Number of key slots in PSA Crypto core" + default 16 + help + Set the number of key slots that are available in the PSA Crypto core. + Be aware that each slot, even if unused, increases RAM consumption + by ~40 bytes plus: + * the length of the largest asymmetric/symmetric key type enabled in + the build through PSA_WANT symbols, if MBEDTLS_PSA_STATIC_KEY_SLOTS + is set. (This is all defined statically at build time). + * the heap-allocated memory to store the key material of a given slot, + if it is used and MBEDTLS_PSA_STATIC_KEY_SLOTS is not set. + +endif # MBEDTLS_PSA_CRYPTO_C + config MBEDTLS_SSL_DTLS_CONNECTION_ID bool "DTLS Connection ID extension" depends on MBEDTLS_DTLS diff --git a/modules/mbedtls/configs/config-tls-generic.h b/modules/mbedtls/configs/config-tls-generic.h index aff59f9e17e76..989d0ad70f2cd 100644 --- a/modules/mbedtls/configs/config-tls-generic.h +++ b/modules/mbedtls/configs/config-tls-generic.h @@ -483,7 +483,6 @@ #endif #if defined(CONFIG_ARCH_POSIX) && !defined(CONFIG_PICOLIBC) -#define MBEDTLS_PSA_KEY_SLOT_COUNT 64 /* for BLE Mesh tests */ #define MBEDTLS_PSA_ITS_FILE_C #define MBEDTLS_FS_IO #endif @@ -494,6 +493,14 @@ #endif /* CONFIG_MBEDTLS_PSA_CRYPTO_C */ +#if defined(CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS) +#define MBEDTLS_PSA_STATIC_KEY_SLOTS +#endif + +#if defined(CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT) +#define MBEDTLS_PSA_KEY_SLOT_COUNT CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT +#endif + #if defined(CONFIG_MBEDTLS_USE_PSA_CRYPTO) #define MBEDTLS_USE_PSA_CRYPTO #endif diff --git a/tests/bsim/bluetooth/mesh/overlay_psa.conf b/tests/bsim/bluetooth/mesh/overlay_psa.conf index 764d8cb6ea494..f5a776bc6da32 100644 --- a/tests/bsim/bluetooth/mesh/overlay_psa.conf +++ b/tests/bsim/bluetooth/mesh/overlay_psa.conf @@ -1,5 +1,8 @@ # Enable PSA as a crypto backend in host CONFIG_BT_USE_PSA_API=y +# Increase the number of key slots in PSA Crypto core +CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT=64 + # Enable mbedTLS PSA as a crypto backend CONFIG_BT_MESH_USES_MBEDTLS_PSA=y diff --git a/tests/crypto/secp256r1/mbedtls.conf b/tests/crypto/secp256r1/mbedtls.conf index e87e14abd71ae..bbc2eb0e65638 100644 --- a/tests/crypto/secp256r1/mbedtls.conf +++ b/tests/crypto/secp256r1/mbedtls.conf @@ -1,6 +1,8 @@ CONFIG_MBEDTLS=y CONFIG_MBEDTLS_PSA_CRYPTO_C=y CONFIG_MBEDTLS_PSA_P256M_DRIVER_ENABLED=y +CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS=y +CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT=2 CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT=y CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE=y diff --git a/west.yml b/west.yml index 87287fb39ac7c..36d5903e742d6 100644 --- a/west.yml +++ b/west.yml @@ -280,7 +280,7 @@ manifest: revision: 2b498e6f36d6b82ae1da12c8b7742e318624ecf5 path: modules/lib/gui/lvgl - name: mbedtls - revision: a78176c6ff0733ba08018cba4447bd3f20de7978 + revision: 4952e1328529ee549d412b498ea71c54f30aa3b1 path: modules/crypto/mbedtls groups: - crypto