1# 2# Copyright (c) 2015-2024, Arm Limited. All rights reserved. 3# 4# SPDX-License-Identifier: BSD-3-Clause 5# 6 7ifneq (${MBEDTLS_COMMON_MK},1) 8MBEDTLS_COMMON_MK := 1 9 10# MBEDTLS_DIR must be set to the mbed TLS main directory (it must contain 11# the 'include' and 'library' subdirectories). 12ifeq (${MBEDTLS_DIR},) 13 $(error Error: MBEDTLS_DIR not set) 14endif 15 16MBEDTLS_INC = -I${MBEDTLS_DIR}/include 17 18MBEDTLS_MAJOR=$(shell grep -hP "define MBEDTLS_VERSION_MAJOR" ${MBEDTLS_DIR}/include/mbedtls/*.h | grep -oe '\([0-9.]*\)') 19MBEDTLS_MINOR=$(shell grep -hP "define MBEDTLS_VERSION_MINOR" ${MBEDTLS_DIR}/include/mbedtls/*.h | grep -oe '\([0-9.]*\)') 20$(info MBEDTLS_VERSION_MAJOR is [${MBEDTLS_MAJOR}] MBEDTLS_VERSION_MINOR is [${MBEDTLS_MINOR}]) 21 22ifneq (${MBEDTLS_MAJOR}, 3) 23 $(error Error: TF-A only supports MbedTLS versions > 3.x) 24endif 25 26# Specify mbed TLS configuration file 27ifeq (${PSA_CRYPTO},1) 28 MBEDTLS_CONFIG_FILE ?= "<drivers/auth/mbedtls/psa_mbedtls_config.h>" 29else 30 MBEDTLS_CONFIG_FILE ?= "<drivers/auth/mbedtls/mbedtls_config-3.h>" 31endif 32 33$(eval $(call add_define,MBEDTLS_CONFIG_FILE)) 34 35MBEDTLS_SOURCES += drivers/auth/mbedtls/mbedtls_common.c 36 37LIBMBEDTLS_SRCS += $(addprefix ${MBEDTLS_DIR}/library/, \ 38 aes.c \ 39 asn1parse.c \ 40 asn1write.c \ 41 cipher.c \ 42 cipher_wrap.c \ 43 constant_time.c \ 44 hash_info.c \ 45 memory_buffer_alloc.c \ 46 oid.c \ 47 platform.c \ 48 platform_util.c \ 49 bignum.c \ 50 bignum_core.c \ 51 gcm.c \ 52 md.c \ 53 pk.c \ 54 pk_wrap.c \ 55 pkparse.c \ 56 pkwrite.c \ 57 sha256.c \ 58 sha512.c \ 59 ecdsa.c \ 60 ecp_curves.c \ 61 ecp.c \ 62 rsa.c \ 63 rsa_alt_helpers.c \ 64 x509.c \ 65 x509_crt.c \ 66 ) 67 68# Currently on Mbedtls-3 there is outstanding bug due to usage 69# of redundant declaration[1], So disable redundant-decls 70# compilation flag to avoid compilation error when compiling with 71# Mbedtls-3. 72# [1]: https://github.com/Mbed-TLS/mbedtls/issues/6910 73LIBMBEDTLS_CFLAGS += -Wno-error=redundant-decls 74 75ifeq (${PSA_CRYPTO},1) 76LIBMBEDTLS_SRCS += $(addprefix ${MBEDTLS_DIR}/library/, \ 77 psa_crypto.c \ 78 psa_crypto_client.c \ 79 psa_crypto_driver_wrappers.c \ 80 psa_crypto_hash.c \ 81 psa_crypto_rsa.c \ 82 psa_crypto_ecp.c \ 83 psa_crypto_slot_management.c \ 84 ) 85endif 86 87# The platform may define the variable 'TF_MBEDTLS_KEY_ALG' to select the key 88# algorithm to use. If the variable is not defined, select it based on 89# algorithm used for key generation `KEY_ALG`. If `KEY_ALG` is not defined, 90# then it is set to `rsa`. 91ifeq (${TF_MBEDTLS_KEY_ALG},) 92 ifeq (${KEY_ALG}, ecdsa) 93 TF_MBEDTLS_KEY_ALG := ecdsa 94 else 95 TF_MBEDTLS_KEY_ALG := rsa 96 endif 97endif 98 99ifeq (${TF_MBEDTLS_KEY_SIZE},) 100 ifneq ($(findstring rsa,${TF_MBEDTLS_KEY_ALG}),) 101 ifeq (${KEY_SIZE},) 102 TF_MBEDTLS_KEY_SIZE := 2048 103 else ifneq ($(filter $(KEY_SIZE), 1024 2048 3072 4096),) 104 TF_MBEDTLS_KEY_SIZE := ${KEY_SIZE} 105 else 106 $(error "Invalid value for KEY_SIZE: ${KEY_SIZE}") 107 endif 108 else ifneq ($(findstring ecdsa,${TF_MBEDTLS_KEY_ALG}),) 109 ifeq (${KEY_SIZE},) 110 TF_MBEDTLS_KEY_SIZE := 256 111 else ifneq ($(filter $(KEY_SIZE), 256 384),) 112 TF_MBEDTLS_KEY_SIZE := ${KEY_SIZE} 113 else 114 $(error "Invalid value for KEY_SIZE: ${KEY_SIZE}") 115 endif 116 endif 117endif 118 119ifeq (${HASH_ALG}, sha384) 120 TF_MBEDTLS_HASH_ALG_ID := TF_MBEDTLS_SHA384 121else ifeq (${HASH_ALG}, sha512) 122 TF_MBEDTLS_HASH_ALG_ID := TF_MBEDTLS_SHA512 123else 124 TF_MBEDTLS_HASH_ALG_ID := TF_MBEDTLS_SHA256 125endif 126 127ifeq (${TF_MBEDTLS_KEY_ALG},ecdsa) 128 TF_MBEDTLS_KEY_ALG_ID := TF_MBEDTLS_ECDSA 129else ifeq (${TF_MBEDTLS_KEY_ALG},rsa) 130 TF_MBEDTLS_KEY_ALG_ID := TF_MBEDTLS_RSA 131else ifeq (${TF_MBEDTLS_KEY_ALG},rsa+ecdsa) 132 TF_MBEDTLS_KEY_ALG_ID := TF_MBEDTLS_RSA_AND_ECDSA 133else 134 $(error "TF_MBEDTLS_KEY_ALG=${TF_MBEDTLS_KEY_ALG} not supported on mbed TLS") 135endif 136 137ifeq (${DECRYPTION_SUPPORT}, aes_gcm) 138 TF_MBEDTLS_USE_AES_GCM := 1 139else 140 TF_MBEDTLS_USE_AES_GCM := 0 141endif 142 143# Needs to be set to drive mbed TLS configuration correctly 144$(eval $(call add_defines,\ 145 $(sort \ 146 TF_MBEDTLS_KEY_ALG_ID \ 147 TF_MBEDTLS_KEY_SIZE \ 148 TF_MBEDTLS_HASH_ALG_ID \ 149 TF_MBEDTLS_USE_AES_GCM \ 150))) 151 152$(eval $(call MAKE_LIB,mbedtls)) 153 154endif 155