1#
2# Copyright (c) 2015-2024, Arm Limited. All rights reserved.
3#
4# SPDX-License-Identifier: BSD-3-Clause
5#
6
7ifneq (${MBEDTLS_COMMON_MK},1)
8MBEDTLS_COMMON_MK	:=	1
9
10# MBEDTLS_DIR must be set to the mbed TLS main directory (it must contain
11# the 'include' and 'library' subdirectories).
12ifeq (${MBEDTLS_DIR},)
13  $(error Error: MBEDTLS_DIR not set)
14endif
15
16MBEDTLS_INC		=	-I${MBEDTLS_DIR}/include
17
18MBEDTLS_MAJOR=$(shell grep -hP "define MBEDTLS_VERSION_MAJOR" ${MBEDTLS_DIR}/include/mbedtls/*.h | grep -oe '\([0-9.]*\)')
19MBEDTLS_MINOR=$(shell grep -hP "define MBEDTLS_VERSION_MINOR" ${MBEDTLS_DIR}/include/mbedtls/*.h | grep -oe '\([0-9.]*\)')
20$(info MBEDTLS_VERSION_MAJOR is [${MBEDTLS_MAJOR}] MBEDTLS_VERSION_MINOR is [${MBEDTLS_MINOR}])
21
22ifneq (${MBEDTLS_MAJOR}, 3)
23  $(error Error: TF-A only supports MbedTLS versions > 3.x)
24endif
25
26# Specify mbed TLS configuration file
27ifeq (${PSA_CRYPTO},1)
28  MBEDTLS_CONFIG_FILE    ?=    "<drivers/auth/mbedtls/psa_mbedtls_config.h>"
29else
30  MBEDTLS_CONFIG_FILE    ?=    "<drivers/auth/mbedtls/mbedtls_config-3.h>"
31endif
32
33$(eval $(call add_define,MBEDTLS_CONFIG_FILE))
34
35MBEDTLS_SOURCES	+=		drivers/auth/mbedtls/mbedtls_common.c
36
37LIBMBEDTLS_SRCS		+= $(addprefix ${MBEDTLS_DIR}/library/,		\
38					aes.c 				\
39					asn1parse.c 			\
40					asn1write.c 			\
41					cipher.c 			\
42					cipher_wrap.c 			\
43					constant_time.c			\
44					memory_buffer_alloc.c		\
45					oid.c 				\
46					platform.c 			\
47					platform_util.c			\
48					bignum.c			\
49					bignum_core.c			\
50					gcm.c 				\
51					md.c				\
52					pk.c 				\
53					pk_ecc.c 			\
54					pk_wrap.c 			\
55					pkparse.c 			\
56					pkwrite.c 			\
57					sha256.c            		\
58					sha512.c            		\
59					ecdsa.c				\
60					ecp_curves.c			\
61					ecp.c				\
62					rsa.c				\
63					rsa_alt_helpers.c		\
64					x509.c 				\
65					x509_crt.c 			\
66					)
67
68ifeq (${PSA_CRYPTO},1)
69LIBMBEDTLS_SRCS         += $(addprefix ${MBEDTLS_DIR}/library/,    	\
70					psa_crypto.c                   	\
71					psa_crypto_client.c            	\
72					psa_crypto_hash.c              	\
73					psa_crypto_rsa.c               	\
74					psa_crypto_ecp.c               	\
75					psa_crypto_slot_management.c   	\
76					psa_crypto_aead.c               \
77					psa_crypto_cipher.c             \
78					psa_util.c			\
79					)
80endif
81
82# The platform may define the variable 'TF_MBEDTLS_KEY_ALG' to select the key
83# algorithm to use. If the variable is not defined, select it based on
84# algorithm used for key generation `KEY_ALG`. If `KEY_ALG` is not defined,
85# then it is set to `rsa`.
86ifeq (${TF_MBEDTLS_KEY_ALG},)
87    ifeq (${KEY_ALG}, ecdsa)
88        TF_MBEDTLS_KEY_ALG		:=	ecdsa
89    else
90        TF_MBEDTLS_KEY_ALG		:=	rsa
91    endif
92endif
93
94ifeq (${TF_MBEDTLS_KEY_SIZE},)
95    ifneq ($(findstring rsa,${TF_MBEDTLS_KEY_ALG}),)
96        ifeq (${KEY_SIZE},)
97            TF_MBEDTLS_KEY_SIZE		:=	2048
98        else ifneq ($(filter $(KEY_SIZE), 1024 2048 3072 4096),)
99            TF_MBEDTLS_KEY_SIZE		:=	${KEY_SIZE}
100        else
101            $(error "Invalid value for KEY_SIZE: ${KEY_SIZE}")
102        endif
103    else ifneq ($(findstring ecdsa,${TF_MBEDTLS_KEY_ALG}),)
104        ifeq (${KEY_SIZE},)
105            TF_MBEDTLS_KEY_SIZE		:=	256
106        else ifneq ($(filter $(KEY_SIZE), 256 384),)
107            TF_MBEDTLS_KEY_SIZE		:=	${KEY_SIZE}
108        else
109            $(error "Invalid value for KEY_SIZE: ${KEY_SIZE}")
110        endif
111    endif
112endif
113
114ifeq (${HASH_ALG}, sha384)
115    TF_MBEDTLS_HASH_ALG_ID	:=	TF_MBEDTLS_SHA384
116else ifeq (${HASH_ALG}, sha512)
117    TF_MBEDTLS_HASH_ALG_ID	:=	TF_MBEDTLS_SHA512
118else
119    TF_MBEDTLS_HASH_ALG_ID	:=	TF_MBEDTLS_SHA256
120endif
121
122ifeq (${MBOOT_EL_HASH_ALG}, sha256)
123    $(eval $(call add_define,TF_MBEDTLS_MBOOT_USE_SHA256))
124else ifeq (${MBOOT_EL_HASH_ALG}, sha384)
125    $(eval $(call add_define,TF_MBEDTLS_MBOOT_USE_SHA384))
126else ifeq (${MBOOT_EL_HASH_ALG}, sha512)
127    $(eval $(call add_define,TF_MBEDTLS_MBOOT_USE_SHA512))
128endif
129
130ifeq (${TF_MBEDTLS_KEY_ALG},ecdsa)
131    TF_MBEDTLS_KEY_ALG_ID	:=	TF_MBEDTLS_ECDSA
132else ifeq (${TF_MBEDTLS_KEY_ALG},rsa)
133    TF_MBEDTLS_KEY_ALG_ID	:=	TF_MBEDTLS_RSA
134else ifeq (${TF_MBEDTLS_KEY_ALG},rsa+ecdsa)
135    TF_MBEDTLS_KEY_ALG_ID	:=	TF_MBEDTLS_RSA_AND_ECDSA
136else
137    $(error "TF_MBEDTLS_KEY_ALG=${TF_MBEDTLS_KEY_ALG} not supported on mbed TLS")
138endif
139
140ifeq (${DECRYPTION_SUPPORT}, aes_gcm)
141    TF_MBEDTLS_USE_AES_GCM	:=	1
142else
143    TF_MBEDTLS_USE_AES_GCM	:=	0
144endif
145
146# Needs to be set to drive mbed TLS configuration correctly
147$(eval $(call add_defines,\
148    $(sort \
149        TF_MBEDTLS_KEY_ALG_ID \
150        TF_MBEDTLS_KEY_SIZE \
151        TF_MBEDTLS_HASH_ALG_ID \
152        TF_MBEDTLS_USE_AES_GCM \
153)))
154
155$(eval $(call MAKE_LIB,mbedtls))
156
157endif
158