1# 2# Copyright (c) 2015-2024, Arm Limited. All rights reserved. 3# 4# SPDX-License-Identifier: BSD-3-Clause 5# 6 7ifneq (${MBEDTLS_COMMON_MK},1) 8MBEDTLS_COMMON_MK := 1 9 10# MBEDTLS_DIR must be set to the mbed TLS main directory (it must contain 11# the 'include' and 'library' subdirectories). 12ifeq (${MBEDTLS_DIR},) 13 $(error Error: MBEDTLS_DIR not set) 14endif 15 16MBEDTLS_INC = -I${MBEDTLS_DIR}/include 17 18MBEDTLS_MAJOR=$(shell grep -hP "define MBEDTLS_VERSION_MAJOR" ${MBEDTLS_DIR}/include/mbedtls/*.h | grep -oe '\([0-9.]*\)') 19MBEDTLS_MINOR=$(shell grep -hP "define MBEDTLS_VERSION_MINOR" ${MBEDTLS_DIR}/include/mbedtls/*.h | grep -oe '\([0-9.]*\)') 20$(info MBEDTLS_VERSION_MAJOR is [${MBEDTLS_MAJOR}] MBEDTLS_VERSION_MINOR is [${MBEDTLS_MINOR}]) 21 22ifneq (${MBEDTLS_MAJOR}, 3) 23 $(error Error: TF-A only supports MbedTLS versions > 3.x) 24endif 25 26# Specify mbed TLS configuration file 27ifeq (${PSA_CRYPTO},1) 28 MBEDTLS_CONFIG_FILE ?= "<drivers/auth/mbedtls/psa_mbedtls_config.h>" 29else 30 MBEDTLS_CONFIG_FILE ?= "<drivers/auth/mbedtls/mbedtls_config-3.h>" 31endif 32 33$(eval $(call add_define,MBEDTLS_CONFIG_FILE)) 34 35MBEDTLS_SOURCES += drivers/auth/mbedtls/mbedtls_common.c 36 37LIBMBEDTLS_SRCS += $(addprefix ${MBEDTLS_DIR}/library/, \ 38 aes.c \ 39 asn1parse.c \ 40 asn1write.c \ 41 cipher.c \ 42 cipher_wrap.c \ 43 constant_time.c \ 44 memory_buffer_alloc.c \ 45 oid.c \ 46 platform.c \ 47 platform_util.c \ 48 bignum.c \ 49 bignum_core.c \ 50 gcm.c \ 51 md.c \ 52 pk.c \ 53 pk_ecc.c \ 54 pk_wrap.c \ 55 pkparse.c \ 56 pkwrite.c \ 57 sha256.c \ 58 sha512.c \ 59 ecdsa.c \ 60 ecp_curves.c \ 61 ecp.c \ 62 rsa.c \ 63 rsa_alt_helpers.c \ 64 x509.c \ 65 x509_crt.c \ 66 ) 67 68ifeq (${PSA_CRYPTO},1) 69LIBMBEDTLS_SRCS += $(addprefix ${MBEDTLS_DIR}/library/, \ 70 psa_crypto.c \ 71 psa_crypto_client.c \ 72 psa_crypto_hash.c \ 73 psa_crypto_rsa.c \ 74 psa_crypto_ecp.c \ 75 psa_crypto_slot_management.c \ 76 psa_util.c \ 77 ) 78endif 79 80# The platform may define the variable 'TF_MBEDTLS_KEY_ALG' to select the key 81# algorithm to use. If the variable is not defined, select it based on 82# algorithm used for key generation `KEY_ALG`. If `KEY_ALG` is not defined, 83# then it is set to `rsa`. 84ifeq (${TF_MBEDTLS_KEY_ALG},) 85 ifeq (${KEY_ALG}, ecdsa) 86 TF_MBEDTLS_KEY_ALG := ecdsa 87 else 88 TF_MBEDTLS_KEY_ALG := rsa 89 endif 90endif 91 92ifeq (${TF_MBEDTLS_KEY_SIZE},) 93 ifneq ($(findstring rsa,${TF_MBEDTLS_KEY_ALG}),) 94 ifeq (${KEY_SIZE},) 95 TF_MBEDTLS_KEY_SIZE := 2048 96 else ifneq ($(filter $(KEY_SIZE), 1024 2048 3072 4096),) 97 TF_MBEDTLS_KEY_SIZE := ${KEY_SIZE} 98 else 99 $(error "Invalid value for KEY_SIZE: ${KEY_SIZE}") 100 endif 101 else ifneq ($(findstring ecdsa,${TF_MBEDTLS_KEY_ALG}),) 102 ifeq (${KEY_SIZE},) 103 TF_MBEDTLS_KEY_SIZE := 256 104 else ifneq ($(filter $(KEY_SIZE), 256 384),) 105 TF_MBEDTLS_KEY_SIZE := ${KEY_SIZE} 106 else 107 $(error "Invalid value for KEY_SIZE: ${KEY_SIZE}") 108 endif 109 endif 110endif 111 112ifeq (${HASH_ALG}, sha384) 113 TF_MBEDTLS_HASH_ALG_ID := TF_MBEDTLS_SHA384 114else ifeq (${HASH_ALG}, sha512) 115 TF_MBEDTLS_HASH_ALG_ID := TF_MBEDTLS_SHA512 116else 117 TF_MBEDTLS_HASH_ALG_ID := TF_MBEDTLS_SHA256 118endif 119 120ifeq (${MBOOT_EL_HASH_ALG}, sha256) 121 $(eval $(call add_define,TF_MBEDTLS_MBOOT_USE_SHA256)) 122else ifeq (${MBOOT_EL_HASH_ALG}, sha384) 123 $(eval $(call add_define,TF_MBEDTLS_MBOOT_USE_SHA384)) 124else ifeq (${MBOOT_EL_HASH_ALG}, sha512) 125 $(eval $(call add_define,TF_MBEDTLS_MBOOT_USE_SHA512)) 126endif 127 128ifeq (${TF_MBEDTLS_KEY_ALG},ecdsa) 129 TF_MBEDTLS_KEY_ALG_ID := TF_MBEDTLS_ECDSA 130else ifeq (${TF_MBEDTLS_KEY_ALG},rsa) 131 TF_MBEDTLS_KEY_ALG_ID := TF_MBEDTLS_RSA 132else ifeq (${TF_MBEDTLS_KEY_ALG},rsa+ecdsa) 133 TF_MBEDTLS_KEY_ALG_ID := TF_MBEDTLS_RSA_AND_ECDSA 134else 135 $(error "TF_MBEDTLS_KEY_ALG=${TF_MBEDTLS_KEY_ALG} not supported on mbed TLS") 136endif 137 138ifeq (${DECRYPTION_SUPPORT}, aes_gcm) 139 TF_MBEDTLS_USE_AES_GCM := 1 140else 141 TF_MBEDTLS_USE_AES_GCM := 0 142endif 143 144# Needs to be set to drive mbed TLS configuration correctly 145$(eval $(call add_defines,\ 146 $(sort \ 147 TF_MBEDTLS_KEY_ALG_ID \ 148 TF_MBEDTLS_KEY_SIZE \ 149 TF_MBEDTLS_HASH_ALG_ID \ 150 TF_MBEDTLS_USE_AES_GCM \ 151))) 152 153$(eval $(call MAKE_LIB,mbedtls)) 154 155endif 156