Update Mbed TLS to 2.24.0 and Mbed PSA service #14160

LDong-Arm · 2021-01-15T17:22:40Z

Summary of changes

As a prerequisite of TF-M 1.2 update, this PR updates Mbed TLS to 2.24.0 and Mbed PSA service (used by PSA-enabled single-core v7m targets such as K64F) that comes with Mbed TLS.

Notes:

hash_wrappers.c has been moved from connectivity/mbedtls/source/ (intended for imported Mbed TLS code only) to connectivity/mbedtls/platform/src/ as it's specific to Mbed OS.
common.h has been moved from connectivity/mbedtls/source/ to connectivity/mbedtls/include/mbedtls/, because this header is also used by PSA (since Mbed TLS 2.24.0) and thus needs to be in the exported include path.

Impact of changes

This updates works with all non-PSA targets and those PSA targets with TF-M 1.2 support. This means:

No impact on non-PSA targets
Single-core v7m targets (e.g. K64F) will work following the update
Musca B1 and S1 are out of scope and to be covered in TF-M v1.2 integration #14187
CYTFM_064B0S2_4343W will not work. Update to TF-M 1.2 to be discuss with Cypress
All Cypress targets will not compile, because Mbed TLS 2.24.0 introduced a new API mbedtls_ecp_write_key() which is missing from Cypress's ecp_alt.c. Until this function is imported, applications and tests will fail to compile with the Arm toolchain for all Cypress targets, due to missing symbols.

So some tests in CI will not pass, until the entire TF-M 1.2 integration work is complete. Since this is incremental work on a feature branch, we may merge it and implement the rest subsequently.

Migration actions required

None.

Documentation

None.

Pull request type

[] Patch update (Bug fix / Target update / Docs update / Test update / Refactor)
[] Feature update (New feature / Functionality change / New API)
[*] Major update (Breaking change E.g. Return code change / API behaviour change)

(Changes in PSA API)

Test results

[] No Tests required for this change (E.g docs only update)
[x] Covered by existing mbed-os tests (Greentea or Unittest)
[] Tests / results supplied as part of this PR

Reviewers

@jainvikas8 @evedon

ciarmcom · 2021-01-15T17:30:21Z

@LDong-Arm, thank you for your changes.
@jainvikas8 @evedon @ARMmbed/mbed-os-maintainers please review.

LDong-Arm · 2021-01-18T11:06:24Z

Hi @0xc0170, is it possible to run our CI on this PR? We'd like a one-off run to see how it impacts existing Mbed targets, thanks in advance.

0xc0170 · 2021-01-18T11:12:01Z

CI started

LDong-Arm · 2021-01-18T13:45:37Z

Looks like CI is stuck at fetching mbed-os

0xc0170 · 2021-01-18T16:46:43Z

Restarted, Ci is having some network instability today.

evedon

Change looks good, pending green CI result for targets (except Musca B1, S1 and
CYTFM_064B0S2_4343W).

This is an integration branch so the work will be done incrementally.

LDong-Arm · 2021-01-19T09:43:40Z

Fetching of mbed-os failed in CI

LDong-Arm · 2021-01-20T09:11:21Z

@0xc0170 Shall we rerun CI on this, thanks!

0xc0170 · 2021-01-20T14:58:38Z

Restarted

mbed-ci · 2021-01-20T15:44:39Z

Jenkins CI Test : ❌ FAILED

Build Number: 3 | 🔒 Jenkins CI Job | 🌐 Logs & Artifacts

CLICK for Detailed Summary

jobs	Status
jenkins-ci/mbed-os-ci_unittests	✔️
jenkins-ci/mbed-os-ci_cmake-example-GCC_ARM	❌
jenkins-ci/mbed-os-ci_cmake-example-ARM	❌
jenkins-ci/mbed-os-ci_build-greentea-ARM	❌
jenkins-ci/mbed-os-ci_build-greentea-GCC_ARM	❌
jenkins-ci/mbed-os-ci_build-example-GCC_ARM	❌
jenkins-ci/mbed-os-ci_build-cloud-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_build-example-ARM	❌
jenkins-ci/mbed-os-ci_build-cloud-example-ARM	✔️

LDong-Arm · 2021-01-20T16:20:53Z

From the CI run,

The CMake examples tests have caught a real error in this PR (missing hash_wrappers.c in Mbed TLS) - I'll push a fix
All other failures (TF-M targets) are completely expected

Pull request has been modified.

LDong-Arm · 2021-01-20T16:30:29Z

hash_wrappers.c was accidentally deleted by the import script. To avoid this happening again, I've moved it from connectivity/mbedtls/source/ (intended for imported Mbed TLS code only) to connectivity/mbedtls/platform/src/ (Mbed OS specific code), and updated CMakeLists.txt accordingly.

@evedon @jainvikas8 Are you happy with this? A re-approval is needed, then we can rerun CI (I'm sure it'll be good this time) and merge it.

hash_wrappers.c is specific to Mbed OS, moving it into platform as its original directory is for imported Mbed TLS source only.

LDong-Arm

@0xc0170 Can we run CI on this again? @jainvikas8 (the reviewer) has gone through this PR with me, so it's almost ready.

LDong-Arm · 2021-01-21T15:07:29Z

connectivity/mbedtls/include/mbedtls/aes.h

@@ -20,7 +20,8 @@
 *          <https://ieeexplore.ieee.org/servlet/opac?punumber=4375278>.
 */

-/*  Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved.
+/*
+ *  Copyright The Mbed TLS Contributors


@0xc0170 This copyright change was recently made in all files in Mbed TLS. Since the code is imported, are we okay with this?

0xc0170 · 2021-01-22T11:38:31Z

CI started

mbed-ci · 2021-01-22T12:19:51Z

Jenkins CI Test : ❌ FAILED

Build Number: 4 | 🔒 Jenkins CI Job | 🌐 Logs & Artifacts

CLICK for Detailed Summary

jobs	Status
jenkins-ci/mbed-os-ci_unittests	✔️
jenkins-ci/mbed-os-ci_cmake-example-GCC_ARM	❌
jenkins-ci/mbed-os-ci_cmake-example-ARM	❌
jenkins-ci/mbed-os-ci_build-greentea-GCC_ARM	❌
jenkins-ci/mbed-os-ci_build-greentea-ARM	❌
jenkins-ci/mbed-os-ci_build-cloud-example-ARM	✔️
jenkins-ci/mbed-os-ci_build-cloud-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_build-example-ARM	❌
jenkins-ci/mbed-os-ci_build-example-GCC_ARM	❌

Note: Now we need to export common.h to the include path, because this header is now also needed by PSA Crypto service.

Files have been automatically imported by setting MBED_TLS_RELEASE to mbedtls-2.24.0 in connectivity/mbedtls/tools/importer/Makefile and running `make` in that directory.

evedon · 2021-01-25T09:27:49Z

hash_wrappers.c was accidentally deleted by the import script. To avoid this happening again, I've moved it from connectivity/mbedtls/source/ (intended for imported Mbed TLS code only) to connectivity/mbedtls/platform/src/ (Mbed OS specific code), and updated CMakeLists.txt accordingly.

@evedon @jainvikas8 Are you happy with this? A re-approval is needed, then we can rerun CI (I'm sure it'll be good this time) and merge it.

That is the correct thing to do.

Pull request has been modified.

LDong-Arm · 2021-01-25T10:24:07Z

I've made a fix since the last CI run: common.h has been moved from connectivity/mbedtls/source/ to connectivity/mbedtls/include/mbedtls/, because this header is also used by PSA (which sits in a different location in Mbed OS) thus it needs to be in the exported include path. Now I believe all non-TF-M and non-Cypress targets should pass next time.

Note: All Cypress targets will not compile, because Mbed TLS 2.24.0 introduced a new API mbedtls_ecp_write_key() which is missing from Cypress's ecp_alt.c. Until this function is imported, applications and tests will fail to compile with the Arm toolchain for all Cypress targets, due to missing symbols.

connectivity/mbedtls/tools/importer/Makefile

LDong-Arm · 2021-01-26T11:50:35Z

@evedon Thanks for the review.
@0xc0170 Would you please start CI on this?

0xc0170 · 2021-01-26T15:16:51Z

CI started

mbed-ci · 2021-01-26T15:48:52Z

Jenkins CI Test : ❌ FAILED

Build Number: 5 | 🔒 Jenkins CI Job | 🌐 Logs & Artifacts

CLICK for Detailed Summary

jobs	Status
jenkins-ci/mbed-os-ci_unittests	✔️
jenkins-ci/mbed-os-ci_cmake-example-ARM	❌
jenkins-ci/mbed-os-ci_cmake-example-GCC_ARM	❌
jenkins-ci/mbed-os-ci_build-greentea-GCC_ARM	❌
jenkins-ci/mbed-os-ci_build-greentea-ARM	❌
jenkins-ci/mbed-os-ci_build-cloud-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_build-example-ARM	❌
jenkins-ci/mbed-os-ci_build-example-GCC_ARM	❌
jenkins-ci/mbed-os-ci_build-cloud-example-ARM	✔️

LDong-Arm · 2021-01-26T15:55:06Z

All failures are expected:

mbed-os-example-lorawan CMake build for K64F: recently fixed by 5616537 on master branch, but our feature branch lags behind. This should be automatically resolved once we merge back to master
Examples and Greentea fail to build for TF-M targets due to ongoing integration work: ARM_MUSCA_B1, ARM_MUSCA_S1 (TF-M v1.2 integration #14187) and CYTFM_064B0S2_4343W (maintained by Cypress)
Examples and Greentea fail to build for Cypress targets, due to a new Mbed TLS API mbedtls_ecp_write_key() missing from Cypress's driver

@evedon This PR should be ready for merge.

mergify bot added the release-version: feature branch label Jan 15, 2021

ciarmcom requested review from evedon, jainvikas8 and a team January 15, 2021 17:30

ciarmcom added the needs: review label Jan 15, 2021

evedon previously approved these changes Jan 19, 2021

View reviewed changes

mergify bot added needs: CI and removed needs: review labels Jan 19, 2021

mergify bot added needs: work and removed needs: CI labels Jan 20, 2021

LDong-Arm force-pushed the mbedtls-2.24-import branch from 9fb9f6a to 6623c5b Compare January 20, 2021 16:25

LDong-Arm requested a review from evedon January 20, 2021 16:38

LDong-Arm force-pushed the mbedtls-2.24-import branch 2 times, most recently from 405b5fb to 1e485af Compare January 21, 2021 15:03

LDong-Arm added 2 commits January 21, 2021 15:03

Add copyright header to hash_wrappers.c

4c09a5d

Move hash_wrappers.c to platform subdirectory

37c22f5

hash_wrappers.c is specific to Mbed OS, moving it into platform as its original directory is for imported Mbed TLS source only.

LDong-Arm force-pushed the mbedtls-2.24-import branch from 1e485af to 47abbf3 Compare January 21, 2021 15:04

LDong-Arm commented Jan 21, 2021

View reviewed changes

mergify bot added needs: CI and removed needs: work labels Jan 22, 2021

mergify bot added needs: work and removed needs: CI labels Jan 22, 2021

LDong-Arm added 2 commits January 22, 2021 17:21

Fix paths in Mbed TLS importer

3f28aad

Note: Now we need to export common.h to the include path, because this header is now also needed by PSA Crypto service.

Import mbedtls-2.24 and Mbed PSA Service (non-TFM)

1b3520f

Files have been automatically imported by setting MBED_TLS_RELEASE to mbedtls-2.24.0 in connectivity/mbedtls/tools/importer/Makefile and running `make` in that directory.

LDong-Arm mentioned this pull request Jan 22, 2021

TF-M v1.2 integration #14187

Merged

evedon previously approved these changes Jan 25, 2021

View reviewed changes

LDong-Arm force-pushed the mbedtls-2.24-import branch from 47abbf3 to 115304c Compare January 25, 2021 10:12

LDong-Arm force-pushed the mbedtls-2.24-import branch from 115304c to 1b3520f Compare January 25, 2021 11:03

LDong-Arm requested review from evedon and jainvikas8 January 25, 2021 11:12

evedon reviewed Jan 26, 2021

View reviewed changes

connectivity/mbedtls/tools/importer/Makefile Show resolved Hide resolved

evedon reviewed Jan 26, 2021

View reviewed changes

connectivity/mbedtls/tools/importer/Makefile Show resolved Hide resolved

evedon approved these changes Jan 26, 2021

View reviewed changes

mergify bot added needs: CI and removed needs: work labels Jan 26, 2021

mergify bot added needs: work and removed needs: CI labels Jan 26, 2021

evedon merged commit d6826f8 into ARMmbed:feature-tf-m-1.2-integration Jan 26, 2021

Update Mbed TLS to 2.24.0 and Mbed PSA service #14160

Update Mbed TLS to 2.24.0 and Mbed PSA service #14160

Uh oh!

Conversation

LDong-Arm commented Jan 15, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary of changes

Impact of changes

Migration actions required

Documentation

Pull request type

Test results

Reviewers

Uh oh!

ciarmcom commented Jan 15, 2021

Uh oh!

LDong-Arm commented Jan 18, 2021

Uh oh!

0xc0170 commented Jan 18, 2021

Uh oh!

LDong-Arm commented Jan 18, 2021

Uh oh!

0xc0170 commented Jan 18, 2021

Uh oh!

evedon left a comment

Choose a reason for hiding this comment

Uh oh!

LDong-Arm commented Jan 19, 2021

Uh oh!

LDong-Arm commented Jan 20, 2021

Uh oh!

0xc0170 commented Jan 20, 2021

Uh oh!

mbed-ci commented Jan 20, 2021

Jenkins CI Test : ❌ FAILED

Build Number: 3 | 🔒 Jenkins CI Job | 🌐 Logs & Artifacts

Uh oh!

LDong-Arm commented Jan 20, 2021

Uh oh!

LDong-Arm commented Jan 20, 2021

Uh oh!

LDong-Arm left a comment

Choose a reason for hiding this comment

Uh oh!

LDong-Arm Jan 21, 2021

Choose a reason for hiding this comment

Uh oh!

0xc0170 commented Jan 22, 2021

Uh oh!

mbed-ci commented Jan 22, 2021

Jenkins CI Test : ❌ FAILED

Build Number: 4 | 🔒 Jenkins CI Job | 🌐 Logs & Artifacts

Uh oh!

evedon commented Jan 25, 2021

Uh oh!

LDong-Arm commented Jan 25, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

LDong-Arm commented Jan 26, 2021

Uh oh!

0xc0170 commented Jan 26, 2021

Uh oh!

mbed-ci commented Jan 26, 2021

Jenkins CI Test : ❌ FAILED

Build Number: 5 | 🔒 Jenkins CI Job | 🌐 Logs & Artifacts

Uh oh!

LDong-Arm commented Jan 26, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

LDong-Arm commented Jan 15, 2021 •

edited

Loading

LDong-Arm commented Jan 25, 2021 •

edited

Loading

LDong-Arm commented Jan 26, 2021 •

edited

Loading