Skip to content

Commit 1128125

Browse files
ATmobicapull[bot]
ATmobica
authored and
pull[bot]
committed
[OIS] Add PSA crypto backend support (#27387)
This commit allows the selection of PSA as the cryptographic algorithm used when building Matter CryptoPAL with the Open IoT SDK. The GitHub CI workflow for the SDK examples/unit tests has been updated to building and tesitng the lock-app example and unit-tests with both mbedtls and psa cryptographic algorithms. Add call to psa_crypto_init() The Matter PSA implementation still uses some underlying MbedTLS functions (including random number generation). To use these functions however a call to psa_crypto_init() is required. Extend Matter Python builder with crypto backend options. Enable ECP optimization. Signed-off-by: Anna Bridge <anna.bridge@arm.com>
1 parent 8151713 commit 1128125

22 files changed

+219
-66
lines changed

‎.github/.wordlist.txt

+1
Original file line numberDiff line numberDiff line change
@@ -1072,6 +1072,7 @@ ProxyDiscovery
10721072
ProxyValid
10731073
ProxyView
10741074
PRs
1075+
PSA
10751076
PSCAN
10761077
PSECT
10771078
PSK

‎.github/workflows/examples-openiotsdk.yaml

+44-12
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ env:
3232
jobs:
3333
openiotsdk:
3434
name: Open IoT SDK examples building
35-
timeout-minutes: 90
35+
timeout-minutes: 120
3636

3737
env:
3838
TEST_NETWORK_NAME: OIStest
@@ -97,21 +97,21 @@ jobs:
9797
examples/shell/openiotsdk/build/chip-openiotsdk-shell-example.elf \
9898
/tmp/bloat_reports/
9999
100-
- name: Build lock-app example
101-
id: build_lock_app
100+
- name: Build lock-app example (mbedtls)
101+
id: build_lock_app_mbedtls
102102
timeout-minutes: 10
103103
run: |
104-
scripts/examples/openiotsdk_example.sh lock-app
104+
scripts/examples/openiotsdk_example.sh -b mbedtls lock-app
105105
.environment/pigweed-venv/bin/python3 scripts/tools/memory/gh_sizes.py \
106-
openiotsdk release lock-app \
106+
openiotsdk release lock-app-mbedtls \
107107
examples/lock-app/openiotsdk/build/chip-openiotsdk-lock-app-example.elf \
108108
/tmp/bloat_reports/
109109
110-
- name: Build unit tests
111-
id: build_unit_tests
110+
- name: Build unit tests (mbedtls)
111+
id: build_unit_tests_mbedtls
112112
timeout-minutes: 10
113113
run: |
114-
scripts/examples/openiotsdk_example.sh unit-tests
114+
scripts/examples/openiotsdk_example.sh -b mbedtls unit-tests
115115
116116
- name: "Test: shell example"
117117
if: steps.build_shell.outcome == 'success'
@@ -120,17 +120,49 @@ jobs:
120120
scripts/run_in_python_env.sh out/venv \
121121
'scripts/examples/openiotsdk_example.sh --no-activate -C test shell'
122122
123-
- name: "Test: lock-app example"
124-
if: steps.build_lock_app.outcome == 'success'
123+
- name: "Test: lock-app example (mbedtls)"
124+
if: steps.build_lock_app_mbedtls.outcome == 'success'
125125
timeout-minutes: 5
126126
run: |
127127
scripts/setup/openiotsdk/network_setup.sh -n $TEST_NETWORK_NAME up
128128
scripts/run_in_python_env.sh out/venv \
129129
'scripts/run_in_ns.sh ${TEST_NETWORK_NAME}ns scripts/examples/openiotsdk_example.sh --no-activate -C test -n ${TEST_NETWORK_NAME}tap lock-app'
130130
scripts/setup/openiotsdk/network_setup.sh -n $TEST_NETWORK_NAME down
131131
132-
- name: "Test: unit-tests"
133-
if: steps.build_unit_tests.outcome == 'success'
132+
- name: "Test: unit-tests (mbedtls)"
133+
if: steps.build_unit_tests_mbedtls.outcome == 'success'
134+
timeout-minutes: 40
135+
run: |
136+
scripts/run_in_python_env.sh out/venv \
137+
'scripts/examples/openiotsdk_example.sh --no-activate -C test unit-tests'
138+
139+
- name: Build lock-app example (psa)
140+
id: build_lock_app_psa
141+
timeout-minutes: 10
142+
run: |
143+
scripts/examples/openiotsdk_example.sh -c -b psa lock-app
144+
.environment/pigweed-venv/bin/python3 scripts/tools/memory/gh_sizes.py \
145+
openiotsdk release lock-app-psa \
146+
examples/lock-app/openiotsdk/build/chip-openiotsdk-lock-app-example.elf \
147+
/tmp/bloat_reports/
148+
149+
- name: Build unit tests (psa)
150+
id: build_unit_tests_psa
151+
timeout-minutes: 10
152+
run: |
153+
scripts/examples/openiotsdk_example.sh -b psa unit-tests
154+
155+
- name: "Test: lock-app example (psa)"
156+
if: steps.build_lock_app_psa.outcome == 'success'
157+
timeout-minutes: 5
158+
run: |
159+
scripts/setup/openiotsdk/network_setup.sh -n $TEST_NETWORK_NAME up
160+
scripts/run_in_python_env.sh out/venv \
161+
'scripts/run_in_ns.sh ${TEST_NETWORK_NAME}ns scripts/examples/openiotsdk_example.sh --no-activate -C test -n ${TEST_NETWORK_NAME}tap lock-app'
162+
scripts/setup/openiotsdk/network_setup.sh -n $TEST_NETWORK_NAME down
163+
164+
- name: "Test: unit-tests (psa)"
165+
if: steps.build_unit_tests_psa.outcome == 'success'
134166
timeout-minutes: 40
135167
run: |
136168
scripts/run_in_python_env.sh out/venv \

‎.vscode/tasks.json

+9
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,7 @@
251251
"-Cbuild",
252252
"-d${input:openiotsdkDebugMode}",
253253
"-l${input:openiotsdkLwipDebug}",
254+
"-b${input:openiotsdkCryptoBackend}",
254255
"${input:openiotsdkExample}"
255256
],
256257
"group": "build",
@@ -271,6 +272,7 @@
271272
"-Cbuild",
272273
"-d${input:openiotsdkDebugMode}",
273274
"-l${input:openiotsdkLwipDebug}",
275+
"-b${input:openiotsdkCryptoBackend}",
274276
"unit-tests"
275277
],
276278
"group": "build",
@@ -480,6 +482,13 @@
480482
"options": ["false", "true"],
481483
"default": "false"
482484
},
485+
{
486+
"type": "pickString",
487+
"id": "openiotsdkCryptoBackend",
488+
"description": "Which Crypto algorithm do you wish to use?",
489+
"options": ["mbedtls", "psa"],
490+
"default": "mbedtls"
491+
},
483492
{
484493
"type": "command",
485494
"id": "openiotsdkExample",

‎config/openiotsdk/CMakeLists.txt

+1
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ matter_add_gn_arg_bool ("chip_automation_logging" CONFIG_CHIP_AUTO
6262
matter_add_gn_arg_bool ("chip_error_logging" CONFIG_CHIP_ERROR_LOGGING)
6363
matter_add_gn_arg_bool ("chip_openiotsdk_use_tfm" TFM_SUPPORT)
6464
matter_add_gn_arg_bool ("chip_openiotsdk_use_psa_ps" CONFIG_CHIP_OPEN_IOT_SDK_USE_PSA_PS)
65+
matter_add_gn_arg_string("chip_crypto" "${CONFIG_CHIP_CRYPTO}")
6566
if (TARGET cmsis-rtos-api)
6667
matter_add_gn_arg_string("target_os" "cmsis-rtos")
6768
endif()

‎config/openiotsdk/chip-gn/args.gni

-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@ chip_system_config_use_lwip = true
3131
lwip_platform = "external"
3232
chip_system_config_use_sockets = false
3333

34-
chip_crypto = "mbedtls"
3534
chip_external_mbedtls = true
3635

3736
custom_toolchain = "${chip_root}/config/openiotsdk/chip-gn/toolchain:openiotsdk"

‎config/openiotsdk/cmake/chip.cmake

+9-2
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121

2222
get_filename_component(GEN_DIR ${CHIP_ROOT}/zzz_generated/ REALPATH)
2323

24-
# Default CHIP build configuration
24+
# Default CHIP build configuration
2525
set(CONFIG_CHIP_PROJECT_CONFIG "main/include/CHIPProjectConfig.h" CACHE STRING "")
2626
set(CONFIG_CHIP_LIB_TESTS NO CACHE BOOL "")
2727
set(CONFIG_CHIP_LIB_SHELL NO CACHE BOOL "")
@@ -32,6 +32,7 @@ set(CONFIG_CHIP_AUTOMATION_LOGGING YES CACHE BOOL "Enable logging at automation
3232
set(CONFIG_CHIP_ERROR_LOGGING YES CACHE BOOL "Enable logging at error level")
3333

3434
set(CONFIG_CHIP_OPEN_IOT_SDK_USE_PSA_PS NO CACHE BOOL "Enable using PSA Protected Storage")
35+
set(CONFIG_CHIP_CRYPTO "mbedtls" CACHE STRING "Matter crypto backend. Mbedtls as default")
3536

3637
if(CONFIG_CHIP_OPEN_IOT_SDK_USE_PSA_PS AND NOT TFM_SUPPORT)
3738
message( FATAL_ERROR "You can not use PSA Protected Storage without TF-M support" )
@@ -53,8 +54,14 @@ if(TFM_SUPPORT)
5354
add_dependencies(chip-gn tfm-ns-interface)
5455
endif()
5556

57+
if ("${CONFIG_CHIP_CRYPTO}" STREQUAL "psa")
58+
target_compile_definitions(chip
59+
INTERFACE
60+
CONFIG_CHIP_CRYPTO_PSA)
61+
endif()
62+
5663
function(chip_add_data_model target scope model_name)
57-
target_include_directories(${target}
64+
target_include_directories(${target}
5865
PUBLIC
5966
${GEN_DIR}/app-common
6067
${GEN_DIR}/${model_name}-app

‎config/openiotsdk/cmake/sdk.cmake

+18-17
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ get_filename_component(OPEN_IOT_SDK_STORAGE_SOURCE ${CHIP_ROOT}/third_party/open
2727
# Open IoT SDK targets passed to CHIP build
2828
list(APPEND CONFIG_CHIP_EXTERNAL_TARGETS)
2929

30-
# Additional Open IoT SDK build configuration
30+
# Additional Open IoT SDK build configuration
3131
set(TFM_SUPPORT NO CACHE BOOL "Add Trusted Firmware-M (TF-M) support to application")
3232
set(TFM_NS_APP_VERSION "0.0.0" CACHE STRING "TF-M non-secure application version (in the x.x.x format)")
3333
set(CONFIG_CHIP_OPEN_IOT_SDK_LWIP_DEBUG NO CACHE BOOL "Enable LwIP debug logs")
@@ -82,7 +82,7 @@ if(TFM_SUPPORT)
8282
set(TFM_PLATFORM ${OPEN_IOT_SDK_EXAMPLE_COMMON}/tf-m/targets/an552)
8383
set(TFM_PSA_FIRMWARE_UPDATE ON)
8484
set(MCUBOOT_IMAGE_VERSION_NS ${TFM_NS_APP_VERSION})
85-
set(TFM_CMAKE_ARGS "-DCONFIG_TFM_ENABLE_FP=ON;-DTFM_PROFILE=profile_medium;-DTFM_EXCEPTION_INFO_DUMP=ON;-DCONFIG_TFM_HALT_ON_CORE_PANIC=ON;-DTFM_ISOLATION_LEVEL=1")
85+
set(TFM_CMAKE_ARGS "-DCONFIG_TFM_ENABLE_FP=ON;-DTFM_PROFILE=profile_medium;-DTFM_EXCEPTION_INFO_DUMP=ON;-DCONFIG_TFM_HALT_ON_CORE_PANIC=ON;-DTFM_ISOLATION_LEVEL=1;-DTFM_MBEDCRYPTO_PLATFORM_EXTRA_CONFIG_PATH=${OPEN_IOT_SDK_CONFIG}/mbedtls/mbedtls_config_psa.h;-DMBEDCRYPTO_BUILD_TYPE=${CMAKE_BUILD_TYPE};-DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}")
8686
if ("${CMAKE_BUILD_TYPE}" STREQUAL "Debug")
8787
set(TFM_CMAKE_ARGS "${TFM_CMAKE_ARGS};-DMCUBOOT_LOG_LEVEL=INFO;-DTFM_SPM_LOG_LEVEL=TFM_SPM_LOG_LEVEL_DEBUG;-DTFM_PARTITION_LOG_LEVEL=TFM_PARTITION_LOG_LEVEL_INFO")
8888
else()
@@ -117,24 +117,24 @@ endif()
117117
# Add RTOS configuration headers
118118
# Link cmsis-rtos-api against a concrete implementation
119119
if(TARGET cmsis-rtos-api)
120-
target_include_directories(cmsis-core
121-
INTERFACE
120+
target_include_directories(cmsis-core
121+
INTERFACE
122122
cmsis-config
123123
)
124-
124+
125125
target_compile_definitions(cmsis-rtos-api
126126
PUBLIC
127127
DOMAIN_NS=$<IF:$<BOOL:${TFM_SUPPORT}>,1,0>
128128
)
129129

130130
if(TARGET freertos-kernel)
131-
target_include_directories(freertos-kernel
132-
PUBLIC
131+
target_include_directories(freertos-kernel
132+
PUBLIC
133133
freertos-config
134134
)
135135

136-
target_link_libraries(freertos-kernel
137-
PUBLIC
136+
target_link_libraries(freertos-kernel
137+
PUBLIC
138138
cmsis-core
139139
)
140140

@@ -250,14 +250,6 @@ if("cmsis-freertos" IN_LIST IOTSDK_FETCH_LIST)
250250
)
251251
endif()
252252

253-
if("mbedtls" IN_LIST IOTSDK_FETCH_LIST)
254-
list(APPEND CONFIG_CHIP_EXTERNAL_TARGETS
255-
mbedtls
256-
mbedtls-config
257-
mbedtls-threading-cmsis-rtos
258-
)
259-
endif()
260-
261253
if("lwip" IN_LIST IOTSDK_FETCH_LIST)
262254
list(APPEND CONFIG_CHIP_EXTERNAL_TARGETS
263255
lwipcore
@@ -282,6 +274,15 @@ if("trusted-firmware-m" IN_LIST IOTSDK_FETCH_LIST)
282274
)
283275
endif()
284276

277+
# Note: Mbed TLS must appear after TF-M otherwise psa from mbed TLS is used
278+
if("mbedtls" IN_LIST IOTSDK_FETCH_LIST)
279+
list(APPEND CONFIG_CHIP_EXTERNAL_TARGETS
280+
mbedtls
281+
mbedtls-config
282+
mbedtls-threading-cmsis-rtos
283+
)
284+
endif()
285+
285286
# Additional Open IoT SDK port components
286287

287288
# Add Open IoT SDK storage source

‎config/openiotsdk/lwip/user_lwipopts.h

+5
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,11 @@
4949
*/
5050
#define LWIP_RAW (1)
5151

52+
/**
53+
* Disable DHCP as the IP6 link local address can be used.
54+
*/
55+
#define LWIP_DHCP 0
56+
5257
#ifdef LWIP_DEBUG
5358

5459
// Debug Options

‎config/openiotsdk/mbedtls/mbedtls_config.h

+3-3
Original file line numberDiff line numberDiff line change
@@ -2692,7 +2692,7 @@
26922692
* or MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG.
26932693
*
26942694
*/
2695-
#define MBEDTLS_PSA_CRYPTO_C
2695+
//#define MBEDTLS_PSA_CRYPTO_C
26962696

26972697
/**
26982698
* \def MBEDTLS_PSA_CRYPTO_SE_C
@@ -3313,8 +3313,8 @@
33133313
//#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */
33143314

33153315
/* ECP options */
3316-
//#define MBEDTLS_ECP_WINDOW_SIZE 4 /**< Maximum window size used */
3317-
//#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */
3316+
#define MBEDTLS_ECP_WINDOW_SIZE 6 /**< Maximum window size used */
3317+
#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */
33183318

33193319
/* Entropy options */
33203320
//#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */

‎config/openiotsdk/mbedtls/mbedtls_config_psa.h

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
2+
#define MBEDTLS_SHA1_C
3+
#define PSA_WANT_ALG_SHA_1
4+
#define MBEDTLS_ECP_WINDOW_SIZE 6 /**< Maximum window size used */
5+
#undef MBEDTLS_ECP_FIXED_POINT_OPTIM
6+
#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */

0 commit comments

Comments
 (0)