Repository navigation
extmod: Update to MbedTLS V4.2. - #19797
Draft
projectgus wants to merge 11 commits into
Draft
projectgus wants to merge 11 commits into
projectgus wants to merge 11 commits into
Conversation
Extracted from micropython#19725 for this branch, can be removed after that PR merges. This work was funded through GitHub Sponsors. Signed-off-by: Angus Gratton <angus@redyak.com.au>
This is how other ports like stm32 are linked, and allows features such as LTO. In this case it's necessary as we want to apply a linker wrap argument from extmod.mk in a way that works on both ports. (To be added in follow-up commit). This work was funded through GitHub Sponsors. Signed-off-by: Angus Gratton <angus@redyak.com.au>
This is how other ports like stm32 are linked, and allows features such as LTO. In this case it's necessary as we want to apply a linker wrap argument from extmod.mk in a way that works on all Make-based ports. (To be added in follow-up commit). This work was funded through GitHub Sponsors. Signed-off-by: Angus Gratton <angus@redyak.com.au>
Mostly build system changes as V4 requires you to use the library's CMake build system (for codegen, etc). For MicroPython this means calling out to it from CMake builds, and recursively building it for Make-based builds. Retaining support for MbedTLS V3.x is necessary until we stop supporting ESP-IDF V5.x for esp32 port (as it provides its own mbedTLS). This commit breaks MbedTLS on all ports, follow-up commits will enable support on per-port basis. This work was funded through GitHub Sponsors. Signed-off-by: Angus Gratton <angus@redyak.com.au>
Minor updates for code changes in mbedTLS scripts/generate_errors.pl. Additionally the error.fmt has been tweaked to prefix "our" versions with __wrap_, because building mbedTLS v4.x it's not possible to remove the upstream mbedtls_errors.c from the build. This work was funded through GitHub Sponsors. Signed-off-by: Angus Gratton <angus@redyak.com.au>
Some difficulties here because mpconfigport.h pulls in pico-sdk headers but is also how MbedTLS discovers its build config. For now have explicitly skipped pico-sdk headers during the MbedTLS library build, by using a __has_include directive. This work was funded through GitHub Sponsors. Signed-off-by: Angus Gratton <angus@redyak.com.au>
This work was funded through GitHub Sponsors. Signed-off-by: Angus Gratton <angus@redyak.com.au>
In the case of this port the MbedTLS libraries are added to the deplib target, alongside libffi. I think if we converted the executable target from implicit to explicit then these libraries could be built as part of the main target. This work was funded through GitHub Sponsors. Signed-off-by: Angus Gratton <angus@redyak.com.au>
Builds, not yet tested. This work was funded through GitHub Sponsors. Signed-off-by: Angus Gratton <angus@redyak.com.au>
Board ARDUINO_PORTENTA_C33 builds, not yet tested. This work was funded through GitHub Sponsors. Signed-off-by: Angus Gratton <angus@redyak.com.au>
OPENMV_AE3 board builds, untested. This work was funded through GitHub Sponsors. Signed-off-by: Angus Gratton <angus@redyak.com.au>
projectgus
added
port-stm32
extmod
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR updates all ports to use MbedTLS V4.2 (previously V3.6.6).
Read This First
I started this work last month because MbedTLS V3.6 was ending support in March 2027 and V4.1 was previously announced as supported until 2029. While opening this PR I just now stumbled across the announcement that the future of MbedTLS is unclear and all support may stop in April 2027.
Until we know more, I suggest we actually don't spend more time on this PR. V3.x seems simpler in a lot of ways than V4, and it seems possible to me that if MbedTLS does endure after next April then the new maintainers might take a different path forward (although the existing maintainers plan to keep maintaining the "inner" TF-PSA-Crypto library that V4 depends on, so not clear.)
Summary
This work stacks on #19725 (ESP-IDF V6 support, as this also uses MbedTLS V4). The first commit in this branch can be dropped after that PR is merged. After this PR is merged, the only MbedTLS V3 support required is for ESP-IDF V5.x - and can all be dropped out after we no longer support IDF 5.
MbedTLS V4.x is a big update from V3.x, the libraries are more modular and existing functionality has been split up, including a new config layout.
The migration guide also specifies that you must use the MbedTLS CMake build system. I've observed this does code generation and some internal checks, so it seems like our current approach of manually compiling the MbedTLS source files from our own Makefiles/CMakeLists indeed isn't viable.
Therefore the biggest change in this PR is to enable building the MbedTLS library via its own CMake build files. Most notably, the Make-based ports now shell out to a CMake process to build an MbedTLS static library and then link it. This was... fiddly.
Testing
I've only run tests on rp2, stm32 & unix so far, and not exhaustively. Wanted to wait until this PR is ready before spending time on testing.
Some ports (renesas-ra and alif) only support MbedTLS for a single board that I don't have, so will need some assistance from OpenMV to test these.
Tests are
net_inetunit tests andmulti_inetmulti-tests, mostly.Trade-offs and Alternatives
mpconfig[port|board|variant]headers span a lot of layers - they both provide the MbedTLS compile config, but also pull in various SDK and third party headers. As a result, to get the MbedTLS library to build it ends up depending on all these other random headers and layering is a mess. It may be worth thinking about what we can do to layer/modularise this more cleanly (i.e. a "build config" header layer that doesn't depend on any other dependencies.)Generative AI
I did not use generative AI tools when creating this PR.