TF-M: Add path for MBEDCRYPTO for TF-M builds without pulling external trees #34263
Conversation
TF-M uses mbedtls version v.2.25.0, which is different from the one Zephyr uses, so we add an entry in the default manifest for TF-M's mbedtls. west update will checkout the upstream mbedtls version in a directory that is used explicitly by TF-M. Signed-off-by: Ioannis Glaropoulos <Ioannis.Glaropoulos@nordicsemi.no>
Define the MBEDCRYPTO_PATH variable for the TF-M build, so the latter can used a checked-out version of mbedtls, instead of pulling an external tree during build time. This will make Zephyr builds with TF-M must faster. Signed-off-by: Ioannis Glaropoulos <Ioannis.Glaropoulos@nordicsemi.no>
|
The following west manifest projects have been modified in this Pull Request:
Note: This message is automatically posted and updated by the Manifest GitHub Action. |
There was a problem hiding this comment.
I discussed this with @tejlmand earlier, and this solution doesn't take into account the patches that TFM needs to add to mbedtls (see lib/ext/mbedcrypto/*.patch). We now have another option upstream: MBEDCRYPTO_GIT_REMOTE, which we can use to tell TFM to pull the files locally (e.g. from modules/crypto/mbedtls/.git), instead of from the web, after which it automatically applies the patches.
but that requires that the local remote contains the SHA / tag that TF-M will be using, which again puts some requirements to the maintainer of https://github.com/zephyrproject-rtos/mbedtls fork. Also it still has the slight annoyance of cloning mbedtls into each build folder 😞 But for sure a step forward compared to today's solution. Another option could be to create a |
| @@ -150,6 +150,7 @@ function(trusted_firmware_build) | |||
| ${TFM_PROFILE_ARG} | |||
| ${MCUBOOT_IMAGE_NUM_ARG} | |||
| -DTFM_TEST_REPO_PATH=${ZEPHYR_TRUSTED_FIRMWARE_M_MODULE_DIR}/tf-m-tests | |||
| -DMBEDCRYPTO_PATH=${ZEPHYR_TRUSTED_FIRMWARE_M_MODULE_DIR}/../tfm-mbedcrypto | |||
There was a problem hiding this comment.
This may collide with an externally set -DMBEDCRYPTO_PATH
We set this already downstream for nrf_security in nRF Connect SDK
Could this be handled by a specific variable instead of using a relative/full path so downstream users can inject their own settings?
|
Has been addressed via the mbedtls update. |
Fixes #32252