1#
2# Copyright (c) 2015-2024, Arm Limited. All rights reserved.
3#
4# SPDX-License-Identifier: BSD-3-Clause
5#
6
7ifneq (${MBEDTLS_COMMON_MK},1)
8MBEDTLS_COMMON_MK	:=	1
9
10# MBEDTLS_DIR must be set to the mbed TLS main directory (it must contain
11# the 'include' and 'library' subdirectories).
12ifeq (${MBEDTLS_DIR},)
13  $(error Error: MBEDTLS_DIR not set)
14endif
15
16MBEDTLS_INC		=	-I${MBEDTLS_DIR}/include
17
18MBEDTLS_MAJOR=$(shell grep -hP "define MBEDTLS_VERSION_MAJOR" ${MBEDTLS_DIR}/include/mbedtls/*.h | grep -oe '\([0-9.]*\)')
19MBEDTLS_MINOR=$(shell grep -hP "define MBEDTLS_VERSION_MINOR" ${MBEDTLS_DIR}/include/mbedtls/*.h | grep -oe '\([0-9.]*\)')
20$(info MBEDTLS_VERSION_MAJOR is [${MBEDTLS_MAJOR}] MBEDTLS_VERSION_MINOR is [${MBEDTLS_MINOR}])
21
22ifneq (${MBEDTLS_MAJOR}, 3)
23  $(error Error: TF-A only supports MbedTLS versions > 3.x)
24endif
25
26# Specify mbed TLS configuration file
27ifeq (${PSA_CRYPTO},1)
28  MBEDTLS_CONFIG_FILE    ?=    "<drivers/auth/mbedtls/psa_mbedtls_config.h>"
29else
30  MBEDTLS_CONFIG_FILE    ?=    "<drivers/auth/mbedtls/mbedtls_config-3.h>"
31endif
32
33$(eval $(call add_define,MBEDTLS_CONFIG_FILE))
34
35MBEDTLS_SOURCES	+=		drivers/auth/mbedtls/mbedtls_common.c
36
37LIBMBEDTLS_SRCS		+= $(addprefix ${MBEDTLS_DIR}/library/,		\
38					aes.c 				\
39					asn1parse.c 			\
40					asn1write.c 			\
41					cipher.c 			\
42					cipher_wrap.c 			\
43					constant_time.c			\
44					memory_buffer_alloc.c		\
45					oid.c 				\
46					platform.c 			\
47					platform_util.c			\
48					bignum.c			\
49					bignum_core.c			\
50					gcm.c 				\
51					md.c				\
52					pk.c 				\
53					pk_ecc.c 			\
54					pk_wrap.c 			\
55					pkparse.c 			\
56					pkwrite.c 			\
57					sha256.c            		\
58					sha512.c            		\
59					ecdsa.c				\
60					ecp_curves.c			\
61					ecp.c				\
62					rsa.c				\
63					rsa_alt_helpers.c		\
64					x509.c 				\
65					x509_crt.c 			\
66					)
67
68ifeq (${PSA_CRYPTO},1)
69LIBMBEDTLS_CFLAGS 	+= -Wno-error=unused-but-set-variable
70LIBMBEDTLS_SRCS         += $(addprefix ${MBEDTLS_DIR}/library/,    	\
71					psa_crypto.c                   	\
72					psa_crypto_client.c            	\
73					psa_crypto_hash.c              	\
74					psa_crypto_rsa.c               	\
75					psa_crypto_ecp.c               	\
76					psa_crypto_slot_management.c   	\
77					psa_util.c			\
78					)
79endif
80
81# The platform may define the variable 'TF_MBEDTLS_KEY_ALG' to select the key
82# algorithm to use. If the variable is not defined, select it based on
83# algorithm used for key generation `KEY_ALG`. If `KEY_ALG` is not defined,
84# then it is set to `rsa`.
85ifeq (${TF_MBEDTLS_KEY_ALG},)
86    ifeq (${KEY_ALG}, ecdsa)
87        TF_MBEDTLS_KEY_ALG		:=	ecdsa
88    else
89        TF_MBEDTLS_KEY_ALG		:=	rsa
90    endif
91endif
92
93ifeq (${TF_MBEDTLS_KEY_SIZE},)
94    ifneq ($(findstring rsa,${TF_MBEDTLS_KEY_ALG}),)
95        ifeq (${KEY_SIZE},)
96            TF_MBEDTLS_KEY_SIZE		:=	2048
97        else ifneq ($(filter $(KEY_SIZE), 1024 2048 3072 4096),)
98            TF_MBEDTLS_KEY_SIZE		:=	${KEY_SIZE}
99        else
100            $(error "Invalid value for KEY_SIZE: ${KEY_SIZE}")
101        endif
102    else ifneq ($(findstring ecdsa,${TF_MBEDTLS_KEY_ALG}),)
103        ifeq (${KEY_SIZE},)
104            TF_MBEDTLS_KEY_SIZE		:=	256
105        else ifneq ($(filter $(KEY_SIZE), 256 384),)
106            TF_MBEDTLS_KEY_SIZE		:=	${KEY_SIZE}
107        else
108            $(error "Invalid value for KEY_SIZE: ${KEY_SIZE}")
109        endif
110    endif
111endif
112
113ifeq (${HASH_ALG}, sha384)
114    TF_MBEDTLS_HASH_ALG_ID	:=	TF_MBEDTLS_SHA384
115else ifeq (${HASH_ALG}, sha512)
116    TF_MBEDTLS_HASH_ALG_ID	:=	TF_MBEDTLS_SHA512
117else
118    TF_MBEDTLS_HASH_ALG_ID	:=	TF_MBEDTLS_SHA256
119endif
120
121ifeq (${TF_MBEDTLS_KEY_ALG},ecdsa)
122    TF_MBEDTLS_KEY_ALG_ID	:=	TF_MBEDTLS_ECDSA
123else ifeq (${TF_MBEDTLS_KEY_ALG},rsa)
124    TF_MBEDTLS_KEY_ALG_ID	:=	TF_MBEDTLS_RSA
125else ifeq (${TF_MBEDTLS_KEY_ALG},rsa+ecdsa)
126    TF_MBEDTLS_KEY_ALG_ID	:=	TF_MBEDTLS_RSA_AND_ECDSA
127else
128    $(error "TF_MBEDTLS_KEY_ALG=${TF_MBEDTLS_KEY_ALG} not supported on mbed TLS")
129endif
130
131ifeq (${DECRYPTION_SUPPORT}, aes_gcm)
132    TF_MBEDTLS_USE_AES_GCM	:=	1
133else
134    TF_MBEDTLS_USE_AES_GCM	:=	0
135endif
136
137# Needs to be set to drive mbed TLS configuration correctly
138$(eval $(call add_defines,\
139    $(sort \
140        TF_MBEDTLS_KEY_ALG_ID \
141        TF_MBEDTLS_KEY_SIZE \
142        TF_MBEDTLS_HASH_ALG_ID \
143        TF_MBEDTLS_USE_AES_GCM \
144)))
145
146$(eval $(call MAKE_LIB,mbedtls))
147
148endif
149