In order for Mbed TLS to use the PSA Crypto API, definitions of
`MBEDTLS_SVC_KEY_ID_INIT`, `mbedtls_svc_key_id_t` and
`mbedtls_svc_key_id_is_null()` need to be present but are not provided
by the PSA headers from TF-M.
To solve this issue, this commit copies those definitions from Mbed
TLS's original `psa/crypto_types.h` and `psa/crypto_values.h` into a
separate `mbedtls_svc_key_id.h` for TF-M PSA.
The gray-on-black color code used for debug level print-out in
mbed_trace is hard to read. Bright-blue-on-black increases the
brightness of the text without over shadowing the info level
default (white-on-black), thus making it easier to read while
maintaining the original intention.
For original color set MBED_TRACE_COLOR_THEME to 1.
We used to require INITIAL_SP as rtx target headers define it. This should not be required, as
cmsis already defines symbol __INITIAL_SP for all toolchains.
Fixes#14432
Include mbedtls_ecc_group_to_psa.h from crypto_extra.h so that clients
of PSA within Mbed OS do not need to behave differently depending on
which PSA implementation they are using.
This solution is not ideal as it makes it more difficult to update the
TF-M-provided psa/crypto_extra.h. We'll have to see what other options
we have for including additional headers based on the Mbed OS
configuration.
We'd like to enable Mbed TLS's PK module in using TF-M's PSA
implementation, even if it doesn't expose the same set of PSA extensions
as Mbed TLS's PSA implementation. To do this, we add
mbedtls_ecc_group_to_psa() in its own header available when using the
latest TF-M.
Add mbedtls_ecc_group_to_psa(), one of Mbed TLS's PSA compatibility
helpers, for internal use by the Mbed TLS PK module. Without this
conversion function, the Mbed TLS PK module is unable to use any PSA
implementation other than one which provides a compatible set of PSA
extensions.
Update CMAKE_MODULE_PATH at once place.
Note, we update also CMAKE_MODULE_PATH in app.cmake. This is temporary until we get a proper way to include
Mbed Os (removing app.cmake need to be included by an application).
CMAKE_CURRENT_LIST_DIR behaves differently in functions. We store it in the CMakeLists itself, so anyone
calling a function would get the actual list dir where the scripts are.
To illustrate: if I call a function from src/CMakelists.txt, function located in src/scripts, `CMAKE_CURRENT_LIST_DIR` in the function would point
to the src/ folder but not to src/scripts.
The new Apple M1 Mac computers are ARM based. When compiling and running
unit tests on an M1 Mac, the architecture is defined as __arm__
An extra check for __aarch64__ is needed to set MBED_EXCLUSIVE_ACCESS to 0U for the M1
Mac
If not, compilation fails with "Unknown ARM architecture for exclusive access" error
Some host operating systems are case-insensitive and cannot
distinguish (for example) `semaphore.h` in `os_wrapper` from
`Semaphore.h` from Mbed OS `rtos`. This causes the wrong header to be
included.
By adding `os_wrapper/.mbedignore`, we guarantee that
#include "Semaphore.h"
always points to `rtos/Semaphore.h`, while the fully-qualified include
#include "os_wrapper/semaphore.h"
continues to work because its parent directory is still in the include
path.
Previous, we patched TF-M to replace its OS wrapper with CMSIS RTOS
to resolve manage management issue when integrated with Mbed OS. But
as of TF-M v1.2, the OS wrapper has been reworked in the vanilla TF-M,
and now it makes identical calls to its underlying CMSIS RTOS as our
patches do. So, we remove our patches and use vanilla TF-M's OS
wrapper instead to avoid extra maintenance overhead.
This commit re-imports TF-M files associated with the OS wrapper.
This commit adds post binary hook support for TF-M targets.
To apply this hook to a TF-M target, do the following in the target's
`CMakeLists.txt`:
* include `mbed_set_post_build_tfm.cmake`
* call `mbed_post_build_tfm_sign_image()`, passing
- Mbed OS target name
- TF-M target name
- path containing the target's bootloader, layout files and signing
keys
- path to the secure binary
- path to the non-secure binary (i.e. the "raw" Mbed application)
Mbed TLS 2.24.0 requires a few new macros and an inline function in
the PSA Crypto header. This PR adds them to make sure the TF-M v1.0
target (specifically CYTFM_064B0S2_4343W) continues to compile with
the new Mbed TLS.
Note: Support for older versions of TF-M than v1.2 will be dropped,
so existing TF-M targets should migrate to TF-M v1.2 as soon as
possible.
Setting/getting key enrollment algorithm is not recommended and not
part of the vanilla PSA or TF-M. For now keep the API just for
backward compatibility with existing projects, and this commit
adds deprecation warnings.
Add `psa_set_key_enrollment_algorithm()` and
`psa_get_key_enrollment_algorithm()` for TF-M targets.
Note: This is deprecated and for backward compatibility only.
Setting an enrollment algorithm is not recommended, because
using the same key with different algorithms can allow some
attacks based on arithmetic relations between different
computations made with the same key, or can escalate harmless
side channels into exploitable ones. Use this function only
if it is necessary to support a protocol for which it has been
verified that the usage of the key with multiple algorithms
is safe.
The PSA headers imported from TF-M does not contain a declaration of
mbedtls_ecc_group_to_psa(), which is expected by pk.c from Mbed TLS.
This leads to an "undefined symbol" error when using the ARM toolchain
to compile an application for a TF-M target.
These files have been imported/copied from:
* ARMmbed/trusted-firmware-m
* ARMmbed/tf-m-tests
These are generic files, which are required for TF-M v1.2 integration
with Mbed OS for PSA_V8M and PSA_DUAL_CORE targets.
Rather than maintaining a specific `TARGET_TFM_V1_x`, its better to use
more generic name `TARGET_TFM_LATEST` to avoid confusion on the latest
TFM version supported by Mbed OS
* Rename the folder from `TARGET_TFM_V1_1` to `TARGET_TFM_LATEST`
* Update the CmakeLists.txt
* Change the name of the MUSCA targets to maintain uniformity
with TF-M v1.2
* Update target.json for PSA_V8_M to use `TFM_LATEST`
Files have been automatically imported by setting MBED_TLS_RELEASE to
mbedtls-2.24.0 in connectivity/mbedtls/tools/importer/Makefile and
running `make` in that directory.
mbed-os consists of mbed-core and mbed-rtos
mbed-baremetal consists of mbed-core
The main change is for mbed-core. Changing from object library to be interface. This way it allows us to do the above to have 2 main targets for users to use.
This should be backward compatible change as mbed-os target we used contains the same files/options as previously set.
Aside from the core mbed-os CMake target, a number of targets have been created so they can optionally be included by application executables that require them using `target_link_libraries()`.
Co-authored-by: Martin Kojtal <martin.kojtal@arm.com>
Co-authored-by: Rajkumar Kanagaraj <rajkumar.kanagaraj@arm.com>
Scancode found missing license notices in our source files. This commit
addresses those issues by adding an Apache-2.0 notice to source files
highlighted.
Remove the static allocation for the dirent, and allocate it from the
heap during opendir().
Removing the static data can reduce RAM usage on some toolchains when
directories are not being used. The static allocation sometimes is
combined with the file handle array and can't be dropped by the linker.
Original readdir() was not thread-safe at all.
This was in violation of POSIX which states the result of readdir "is
not overwritten by another call to readdir() on a different directory
stream."
POSIX also defines readdir_r() as separate totally reentrant form where
the caller allocates the dirent, but this is generally deprecated as it
opens the door for an inadequate allocation causing a stack smash. Full
reentrancy is not typically necessary - having readdir()'s buffer data
be per-DIR is generally sufficient.
* Move mbed-client-randlib/ headers into include/
(Note: we don't rename it to "randlib" because this library
is mirrored to https://github.com/ARMmbed/mbed-client-randlib,
and "mbed-client-randlib" may be reference by some projects)
* Move the standalone local unit test into tests/unit
Lingkai Dong
Jaeden Amero
Martin Kojtal
Rajkumar Kanagaraj
Marcus Chang
plan-do-break-fix
Maciej Bogusz
mbedmain
Anna Bridge
Ladislas de Toldi
George Psimenos
jeromecoutant
Saheer Babu
Vikas Katariya
caodd
Hugues Kamba
Marc Emmers
Oliver Wildtgrube
Kevin Bracey
Leon
George Beckstein
Hugues Kamba
Evelyne Donnaes
pea-pod
Harrison Mutai
Paul Szczeanek
Moshe Shahar
Gabor Toth