modules: mbedtls: bump to 4.x by valeriosetti · Pull Request #104031 · zephyrproject-rtos/zephyr

valeriosetti · 2026-02-12T23:30:41Z

Implement all the necessary changes which are required to transition from Mbed TLS 3.6.5 to Mbed TLS 4.x:

Update CMake script.
Keep some legacy crypto support for HostAP and EspressIf BT and WiFi drivers.
Adjust samples/tests.

So far only HostAP work need to be finalized.

github-actions · 2026-02-12T23:36:03Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff
hal_nxp	zephyrproject-rtos/hal_nxp@`8d2f015`	zephyrproject-rtos/hal_nxp#679	zephyrproject-rtos/hal_nxp#679/files
hostap	zephyrproject-rtos/hostap@`a659e3d`	zephyrproject-rtos/hostap#125	zephyrproject-rtos/hostap#125/files
mbedtls	zephyrproject-rtos/mbedtls@`c5b06d8`	zephyrproject-rtos/mbedtls#81	zephyrproject-rtos/mbedtls#81/files
mbedtls-3.6 🆕	N/A (Added)	zephyrproject-rtos/mbedtls#82	zephyrproject-rtos/mbedtls#82/files
mldsa-native 🆕	N/A (Added)	zephyrproject-rtos/mldsa-native@`5772b4f` (`development`)	N/A
tf-psa-crypto 🆕	N/A (Added)	zephyrproject-rtos/TF-PSA-Crypto#1	zephyrproject-rtos/TF-PSA-Crypto#1/files

Additional metadata changed:

Name	URL	Submodules	West cmds	`module.yml`	Blobs
mbedtls				✏

⛔ DNM label due to: 3 added projects, 5 projects with PR revision and 1 project with metadata changes

Note: This message is automatically posted and updated by the Manifest GitHub Action.

tomi-font · 2026-03-17T10:23:07Z

modules/mbedtls/CMakeLists.txt

+    #   and TF_PSA_CRYPTO_CONFIG_FILE) which are used in Mbed TLS build, but
+    #   which must also be defined when Zephyr code includes headers
+    #   from Mbed TLS.
+    # - it contains public header directories which are provided by Mbed TLS.


Suggested change

# - it contains public header directories which are provided by Mbed TLS.

# - it contains public include directories which are provided by Mbed TLS.

tomi-font · 2026-03-17T11:11:01Z

MAINTAINERS.yml

    - psa.secure_storage

-"West project: mbedtls-framework":
+"West project: mbedtls-3.6":


commit message will need fixup

tomi-font · 2026-03-17T11:15:40Z

modules/mbedtls/Kconfig


 endchoice # MBEDTLS_IMPLEMENTATION

+config TF_PSA_CRYPTO_CFG_FILE


How about instead of calling this TF_PSA_CRYPTO_CFG_FILE we align this and MBEDTLS_CFG_FILE to use the actual Mbed TLS naming instead (replacing CFG with CONFIG)?

Yes, but is this really required for a bumping PR that already has a good number of commits and changes?

tomi-font · 2026-03-17T11:19:39Z

modules/mbedtls/Kconfig.tf-psa-crypto

+if PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC
+config MBEDTLS_ECP_NIST_OPTIM
+	bool "NSIT curves optimization"
+
+endif


depends on instead? Plus should we rather have this in Kconfig.mbedtls?

Plus should we rather have this in Kconfig.mbedtls?

Why? That's a crypto thing.

tomi-font · 2026-03-17T11:21:16Z

modules/mbedtls/Kconfig

+	help
+	  Use the default TF-PSA-Crypto configuration header file provided by
+	  Zephyr. In this header file all the features are selected by means
+	  of Kconfigs.


Doesn't seem to match the fact that this Kconfig option is a string, not a bool. Maybe just remove this help?

That's actually being used in the CMake file so it's definitely a string. I agree that the description is not correct and perhaps also the location/file. I will change this.

tomi-font · 2026-03-17T11:42:27Z

modules/mbedtls/CMakeLists.txt

+    zephyr_append_cmake_library(mbedx509)
+    zephyr_append_cmake_library(tfpsacrypto)
+
+    # Add Mbed TLS public header directories to the "mbedTLS" interface library.


Suggested change

# Add Mbed TLS public header directories to the "mbedTLS" interface library.

# Add Mbed TLS public include directories to the "mbedTLS" interface library.

tomi-font · 2026-03-17T11:45:03Z

modules/mbedtls/CMakeLists.txt

+    # Add Mbed TLS public header directories to the "mbedTLS" interface library.
+    # Doing this way instead of "target_include_directories()" is better because
+    # we don't need to manually specify any path and if something is changed in
+    # the future in the upstream project in terms of include paths we get that
+    # automatically.
+    inherit_include_directories(mbedTLS INTERFACE mbedtls)
+    inherit_include_directories(mbedTLS INTERFACE mbedx509)
+    inherit_include_directories(mbedTLS INTERFACE tfpsacrypto)


Here doesn't target_link_libraries(mbedTLS INTERFACE tfpsacrypto) (and so on) work?

nope that creates a dependency loop in Cmake

tomi-font · 2026-03-17T11:52:01Z

modules/mbedtls/CMakeLists.txt

+    # in some scenarios.
+    include(${CMAKE_CURRENT_LIST_DIR}/legacy_support.cmake)
+
+    # Add another library to provide Zephyr support


Suggested change

# Add another library to provide Zephyr support

# Add another library to provide Zephyr-specific support

tomi-font · 2026-03-17T11:52:47Z

modules/mbedtls/CMakeLists.txt

+    include(${CMAKE_CURRENT_LIST_DIR}/legacy_support.cmake)
+
+    # Add another library to provide Zephyr support
+    zephyr_library_named(zephyr_mbedtls_support)


Do we need to name it? it doesn't seem so

Suggested change

zephyr_library_named(zephyr_mbedtls_support)

zephyr_library()

tomi-font · 2026-03-17T11:53:10Z

modules/mbedtls/CMakeLists.txt

+    zephyr_library_include_directories(zephyr_mbedtls_support PRIVATE
+      ${CMAKE_CURRENT_SOURCE_DIR}/configs
+      ${CMAKE_CURRENT_SOURCE_DIR}/include
    )


Couldn't we just do

Suggested change

zephyr_library_include_directories(zephyr_mbedtls_support PRIVATE

${CMAKE_CURRENT_SOURCE_DIR}/configs

${CMAKE_CURRENT_SOURCE_DIR}/include

)

zephyr_library_link_libraries(mbedTLS)

?

tejlmand · 2026-03-17T11:02:09Z

west.yml

        - tee
+    - name: tf-psa-crypto
+      revision: pull/1/head
+      path: modules/crypto/mbedtls-4/tf-psa-crypto


this places one west project inside another one.

iirc there are some risks associated with this approach, though I don't fully remember.
@mbolivar do you remember anything in this regard ?

tejlmand · 2026-03-17T11:08:10Z

modules/mbedtls/CMakeLists.txt

+    # Linking to "zephyr_interface" doesn't work in these case because these
+    # are object libraries so properties are NOT propagated from "zephyr_interface".
+    # We need to explicitly do this.
+    propagate_from_zephyr_interface(builtin)


this comment makes no sense.
Object libraries can link to interface libraries and compiling the sources in the object lib will inherit the properties of the interface lib.

So if that doesn't work, then there is something else wrong in the CMake code / design, and that should be fixed instead.

I can help, but you need to explain the issues in order for me to assist.

this comment makes no sense.
Object libraries can link to interface libraries and compiling the sources in the object lib will inherit the properties of the interface lib.

I apologize for the wrong comment, but this was based on my empirical knowledge while working on this topic.
The thing is that differently form mbedtls and mbedx509 libraries, tfpsacrypto is made of several object libraries (the ones you see listed here). The problem that I saw is that zephyr_interface properties like CFLAGS or imacros were not propagated to those object libraries.

So if that doesn't work, then there is something else wrong in the CMake code / design, and that should be fixed instead.

Perhaps the problem is in the Mbed TLS/TF-PSA-Crypto CMake files, but fixing that means investigating the problem, creating the upstream PR, having it reviewed and merged. Based on experience and on the fact that they are busy with their own code freeze, quite for sure this PR won't be merged before some week, making this PR missing the 4.4 code freeze deadline for sure.
Not sure @frkv is OK with this.

tejlmand · 2026-03-17T11:38:51Z

modules/mbedtls/CMakeLists.txt

+    # This is used on Secure Storage compilation.
+    target_compile_definitions(tfpsacrypto PRIVATE BUILDING_MBEDTLS_CRYPTO)
+
+    # Append built libraries to the list of Zephyr ones.


why is this needed ?

The mbedTLS libraries are standard CMake static libs, why do we need them in ZEPHYR_LIBS ?

I basically "copied" what zephyr_library_named is doing:

add_library

zephyr_append_cmake_library

Of course in my case I skipped the first step because add_library is being done by Mbed TLS build system

tejlmand · 2026-03-17T11:42:16Z

modules/mbedtls/CMakeLists.txt

+
+# Inherit include directories from "source_lib" to "target_lib" using the defined "scope"
+function (inherit_include_directories target_lib scope source_lib)
+  get_target_property(source_inc_dirs ${source_lib} INTERFACE_INCLUDE_DIRECTORIES)


this is broken.

Using get_target_property() like this will only get the value of the property as it looks at configure time at this moment, and thus any later calls, such as target_include_directories(<target> PUBLIC/INTERFACE <value>) will not be part of this get_target_property().

Ok, so what's the proper way that I can use to pass the include public directories from mbedtls, mbedx509 and tfpsacrypto to mbedTLS interface lib?

tejlmand · 2026-03-17T11:45:47Z

modules/mbedtls/CMakeLists.txt

+    inherit_include_directories(mbedTLS INTERFACE mbedtls)
+    inherit_include_directories(mbedTLS INTERFACE mbedx509)
+    inherit_include_directories(mbedTLS INTERFACE tfpsacrypto)


do not create functions for this, especially not when such functions are not working correctly.
This can lead to hard-to-debug issues in the future because the code is now very fragile.

tejlmand · 2026-03-17T12:21:47Z

modules/mbedtls/legacy_support.cmake

+  target_sources(builtin PRIVATE ${ZEPHYR_MBEDTLS_MODULE_DIR}/tf-psa-crypto/removed/dhm.c)
+  target_sources(builtin PRIVATE ${ZEPHYR_MBEDTLS_MODULE_DIR}/tf-psa-crypto/removed/des.c)


if legacy files are needed, then those should be added in Zephyr repo, not the Zephyr module, see also: zephyrproject-rtos/TF-PSA-Crypto#1 (review)

Initially I placed them in Zephyr indeed, but then IIRC I got complains from the CI for license issues. I can try to return back to the original implementation, but by any change do you know if Apache-2.0 OR GPL-2.0-or-later is OK for Zephyr?

tejlmand · 2026-03-17T12:31:09Z

modules/mbedtls/legacy_support.cmake

+# This is required because ESP32 drivers for BT and WiFi still rely on legacy
+# crypto.
+if(CONFIG_ESP32_BT_LE_CRYPTO_STACK_MBEDTLS OR CONFIG_ESP32_WIFI_MBEDTLS_CRYPTO)
+  target_sources(builtin PRIVATE ${ZEPHYR_MBEDTLS_MODULE_DIR}/tf-psa-crypto/removed/ecdh.c)


is builtin a mbedTLS target or one created by Zephyr ?

Why are we not creating a dedicated legacy lib with the legacy files needed and compile flags, and then link that lib to the new one, to keep things separate and apply extra compile definitions to files which should not have it ?

builtin is being created by TF-PSA-Crypto.

Why are we not creating a dedicated legacy lib with the legacy files needed and compile flags, and then link that lib to the new one, to keep things separate and apply extra compile definitions to files which should not have it ?

Just tried but it doesn't work. The reason is that even though des, dhm and ecdh belong to the builtin object library, they include files such as tf_psa_crypto_common.h which are in tf-psa-crypto/core folder and that are not exported publicly (so not added to mbedTLS library).

tejlmand · 2026-03-17T12:33:06Z

tests/net/lib/lwm2m/lwm2m_engine/CMakeLists.txt

 target_include_directories(app PRIVATE ${ZEPHYR_BASE}/include/)
 target_include_directories(app PRIVATE ${ZEPHYR_BASE}/subsys/net/lib/lwm2m/)
-target_include_directories(app PRIVATE ${ZEPHYR_BASE}/../modules/crypto/mbedtls/include/)
+target_include_directories(app PRIVATE ${ZEPHYR_BASE}/../modules/crypto/mbedtls-4/include/)


use the ZEPHYR_<module-name>_MODULE_DIR syntax here and below.

tejlmand · 2026-03-17T12:33:24Z

tests/net/lib/wifi_credentials_backend_psa/CMakeLists.txt

 zephyr_include_directories(${ZEPHYR_BASE}/subsys/net/lib/wifi_credentials/)
 zephyr_include_directories(${ZEPHYR_TRUSTED_FIRMWARE_M_MODULE_DIR}/interface/include/)
-zephyr_include_directories(${ZEPHYR_BASE}/../modules/crypto/mbedtls/include/)
+zephyr_include_directories(${ZEPHYR_BASE}/../modules/crypto/mbedtls-3.6/include/)


use the ZEPHYR_<module-name>_MODULE_DIR syntax here.

Nope, that's targetting Mbed TLS 3.6 (build with TF-M) and if zephyrproject-rtos/mbedtls#82 is merged then mbedtls-3.6 won´t be a module

tejlmand · 2026-03-17T12:35:12Z

tests/bluetooth/tester/boards/native_sim.conf

+# Remove optimization otherwise the build will fail when building on 64 bits
+# platforms. Reason: TF-PSA-Crypto includes some assembly optimizations in bignum
+# module. When building for "native_sim/native" the compiler tries to build
+# with 32 bit compatible mode, but assembly function doesn't match and the build
+# just fails.
+CONFIG_NO_OPTIMIZATIONS=y


@aescolar fyi.

sjanc · 2026-03-17T15:50:59Z

#AutoPTS run zephyr SM

codecoup-tester · 2026-03-17T15:52:43Z

Scheduled PR #104031 (comment), board: native+nrf54, estimated start time: 16:53:42, test case count: 67, estimated duration: 0:32:40

Test cases to be run

SM/CEN/PROT/BV-01-C
SM/CEN/JW/BV-01-C
SM/CEN/JW/BV-05-C
SM/CEN/JW/BI-04-C
SM/CEN/JW/BI-01-C
SM/CEN/JW/BI-06-C
SM/CEN/PKE/BV-01-C
SM/CEN/PKE/BV-04-C
SM/CEN/PKE/BI-01-C
SM/CEN/PKE/BI-02-C
SM/CEN/PKE/BI-03-C
SM/CEN/OOB/BV-01-C
SM/CEN/OOB/BV-03-C
SM/CEN/OOB/BV-09-C
SM/CEN/OOB/BI-01-C
SM/CEN/EKS/BV-01-C
SM/CEN/EKS/BI-01-C
SM/CEN/KDU/BV-05-C
SM/CEN/KDU/BV-06-C
SM/CEN/KDU/BV-10-C
SM/CEN/KDU/BI-04-C
SM/CEN/PIS/BV-02-C
SM/CEN/PIS/BV-03-C
SM/CEN/SCJW/BV-01-C
SM/CEN/SCJW/BV-04-C
SM/CEN/SCJW/BI-01-C
SM/CEN/SCPK/BV-01-C
SM/CEN/SCPK/BV-04-C
SM/CEN/SCPK/BI-01-C
SM/CEN/SCPK/BI-02-C
SM/CEN/SCOB/BV-01-C
SM/CEN/SCOB/BV-04-C
SM/CEN/SCOB/BI-01-C
SM/CEN/SCOB/BI-04-C
SM/PER/PROT/BV-02-C
SM/PER/JW/BV-02-C
SM/PER/JW/BI-03-C
SM/PER/JW/BI-02-C
SM/PER/PKE/BV-02-C
SM/PER/PKE/BV-05-C
SM/PER/PKE/BI-03-C
SM/PER/OOB/BV-02-C
SM/PER/OOB/BV-04-C
SM/PER/OOB/BV-10-C
SM/PER/OOB/BI-02-C
SM/PER/EKS/BV-02-C
SM/PER/EKS/BI-02-C
SM/PER/KDU/BV-01-C
SM/PER/KDU/BV-02-C
SM/PER/KDU/BV-07-C
SM/PER/KDU/BV-08-C
SM/PER/KDU/BI-02-C
SM/PER/KDU/BI-03-C
SM/PER/KDU/BI-04-C
SM/PER/PIS/BV-01-C
SM/PER/PIS/BV-02-C
SM/PER/SCJW/BV-02-C
SM/PER/SCJW/BV-03-C
SM/PER/SCJW/BI-02-C
SM/PER/SCPK/BV-02-C
SM/PER/SCPK/BV-03-C
SM/PER/SCPK/BI-03-C
SM/PER/SCPK/BI-04-C
SM/PER/SCOB/BV-02-C
SM/PER/SCOB/BV-03-C
SM/PER/SCOB/BI-02-C
SM/PER/SCOB/BI-03-C

codecoup-tester · 2026-03-17T16:35:04Z

AutoPTS Bot results:
No failed test found.

Successful tests (67)

SM SM/CEN/EKS/BI-01-C PASS
SM SM/CEN/EKS/BV-01-C PASS
SM SM/CEN/JW/BI-01-C PASS
SM SM/CEN/JW/BI-04-C PASS
SM SM/CEN/JW/BI-06-C PASS
SM SM/CEN/JW/BV-01-C PASS
SM SM/CEN/JW/BV-05-C PASS
SM SM/CEN/KDU/BI-04-C PASS
SM SM/CEN/KDU/BV-05-C PASS
SM SM/CEN/KDU/BV-06-C PASS
SM SM/CEN/KDU/BV-10-C PASS
SM SM/CEN/OOB/BI-01-C PASS
SM SM/CEN/OOB/BV-01-C PASS (2)
SM SM/CEN/OOB/BV-03-C PASS
SM SM/CEN/OOB/BV-09-C PASS
SM SM/CEN/PIS/BV-02-C PASS
SM SM/CEN/PIS/BV-03-C PASS
SM SM/CEN/PKE/BI-01-C PASS
SM SM/CEN/PKE/BI-02-C PASS
SM SM/CEN/PKE/BI-03-C PASS
SM SM/CEN/PKE/BV-01-C PASS
SM SM/CEN/PKE/BV-04-C PASS
SM SM/CEN/PROT/BV-01-C PASS
SM SM/CEN/SCJW/BI-01-C PASS
SM SM/CEN/SCJW/BV-01-C PASS
SM SM/CEN/SCJW/BV-04-C PASS
SM SM/CEN/SCOB/BI-01-C PASS (2)
SM SM/CEN/SCOB/BI-04-C PASS
SM SM/CEN/SCOB/BV-01-C PASS
SM SM/CEN/SCOB/BV-04-C PASS
SM SM/CEN/SCPK/BI-01-C PASS
SM SM/CEN/SCPK/BI-02-C PASS
SM SM/CEN/SCPK/BV-01-C PASS
SM SM/CEN/SCPK/BV-04-C PASS
SM SM/PER/EKS/BI-02-C PASS
SM SM/PER/EKS/BV-02-C PASS
SM SM/PER/JW/BI-02-C PASS
SM SM/PER/JW/BI-03-C PASS
SM SM/PER/JW/BV-02-C PASS
SM SM/PER/KDU/BI-02-C PASS
SM SM/PER/KDU/BI-03-C PASS
SM SM/PER/KDU/BI-04-C PASS
SM SM/PER/KDU/BV-01-C PASS
SM SM/PER/KDU/BV-02-C PASS
SM SM/PER/KDU/BV-07-C PASS
SM SM/PER/KDU/BV-08-C PASS
SM SM/PER/OOB/BI-02-C PASS
SM SM/PER/OOB/BV-02-C PASS
SM SM/PER/OOB/BV-04-C PASS
SM SM/PER/OOB/BV-10-C PASS
SM SM/PER/PIS/BV-01-C PASS
SM SM/PER/PIS/BV-02-C PASS
SM SM/PER/PKE/BI-03-C PASS
SM SM/PER/PKE/BV-02-C PASS
SM SM/PER/PKE/BV-05-C PASS
SM SM/PER/PROT/BV-02-C PASS
SM SM/PER/SCJW/BI-02-C PASS
SM SM/PER/SCJW/BV-02-C PASS
SM SM/PER/SCJW/BV-03-C PASS
SM SM/PER/SCOB/BI-02-C PASS
SM SM/PER/SCOB/BI-03-C PASS
SM SM/PER/SCOB/BV-02-C PASS
SM SM/PER/SCOB/BV-03-C PASS
SM SM/PER/SCPK/BI-03-C PASS
SM SM/PER/SCPK/BI-04-C PASS
SM SM/PER/SCPK/BV-02-C PASS
SM SM/PER/SCPK/BV-03-C PASS

stephanosio · 2026-03-17T21:03:57Z

Rebased to fix CI failures.

Extend manifest adding projects for: - Mbed TLS 4.1 - TF-PSA-Crypto 1.1 - Framework for Mbed TLS. The version is the one being pointed to Mbed TLS in upstream project. - Framework for TF-PSA-Crypto. The version is the one being pointed to TF-PSA-Crypto in upstream project. - Mldsa-native. The version is the one being pointed to TF-PSA-Crypto in upstream project. Previous Mbed TLS (v3.6.5) is kept because it's still required to build TF-M. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

Add maintainers for "mbedtls-3.6" project. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

Include a fix for replacing usage of legacy crypto with PSA Crypto API and to prepare for tf-psa-crypto transition. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

…o 1.x Since Mbed TLS and TF-PSA-Crypto are now build based on CMake files as well, instead of manually selecting source files, include folders and building libraries, simply use "add_subdirectory()" and then link the generated libraries. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

TF-PSA-Crypto now requires a different configuration header file compared to Mbed TLS. This commit adds 2 files: - Kconfig.tf-psa-crypto - config-tf-psa-crypto.h which behave exactly the same as for their Mbed TLS counterparts, but for TF-PSA-Crypto. Kconfigs and #defines were migrated from Mbed TLS to TF-PSA-Crypto. This commit didn't implement any re-organization/cleanup/change, but it's just moving lines between files. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

ENTROPY_C is now an internal module in tf-psa-crypto so it cannot be included directly. So first thing all error codes are changed to standard Zephyr ones. Moreover MBEDTLS_ENTROPY_HARDWARE_ALT, MBEDTLS_NO_PLATFORM_ENTROPY and MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES were removed. Now the platform must define MBEDTLS_PSA_DRIVER_GET_ENTROPY when not using MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. Due to the build symbol name change CONFIG_MBEDTLS_ENTROPY_POLL_ZEPHYR is modified to CONFIG_MBEDTLS_PSA_DRIVER_GET_ENTROPY to make a 1:1 match between Kconfig and build symbol. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

tf-psa-crypto deprecated usage of some build symbols and if they are still specified at build time the build will fail. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

"config-psa.h" contains all the Kconfig -> build symbols matching for the "PSA_WANT_xxx", whereas "config-tf-psa-crypto.h" contains the same mapping for the "MBEDTLS_xxx" stuff. However tf-psa-crypto wants a single file with all the configurations in it, so let the latter include the former. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

This is necessary to resolve a wrong dependency between build symbols that should be moved to Kconfig in the future. The comments added in this commit explain this in detail. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

DES and elliptic curves secp192r1, secp192k1 and secp224r1 were removed from tf-psa-crypto. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

Add Kconfigs for major.minor.patch numbers. These information can be helpful to condition some setting of Mbed TLS. New Kconfigs are intentionally added outside of the MBEDTLS guard in order to avoid cyclic dependencies problem. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

Add a Kconfig which still allows to get access to legacy (now internal) Mbed TLS crypto. Legacy header files are copied out of the private folder into the build directory and the folder is the added to the Zephyr build. Morevoer MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS is also set in the Mbed TLS build in order to access functions and macros that wouldn't be accessible otherwise. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

This is temporary as TF-M is supposed to jump to TF-PSA-Crypto soon. However since also Zephyr is transitioning to Mbed TLS/TF-PSA-Crypto right now, it's better to limit to number of simultaneous changes, so for the time keep TF-M relying on Mbed TLS 3.6. In order to keep building with Mbed TLS 3.6 the previous configuration header file is resumed and renamed appropriately. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

This allows NS app to have these headers available at build time without any need to extend its CMake file to explicitly link to "tfm_api" zephyr library. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

Select only PSA_WANT and remove usage of legacy crypto. Extend also Mbed TLS's CMake to build a library which includes legacy Mbed TLS crypto modules that were removed from TF-PSA-Crypto. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

Both PK and TLS now rely on PSA generate random to get random data so end users (i.e. sockets_tls in this case) don't need to manually specify this anymore. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

Minor changes that are required in order to move from Mbed TLS 3.6.5 to TF-PSA-Crypto 1.x: - "psa_crypto_driver_wrappers.h" has been relocated - some extra include folders are required because they are directly included from "psa_crypto_driver_wrappers.h" but not exported from "mbedTLS" library since they are meant to remain private. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

- replace legacy Kconfigs with corresponding PSA_WANT ones. - extend Mbed TLS' CMake file in order to include these legacy ecdh module that was removed from TF-PSA-Crypto when ESP32 BT and WiFi drivers are built. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

This Kconfig enables legacy Mbed TLS crypto support that is now no more available. Kconfig OPENTHREAD_CRYPTO_PSA_CONFIG was already the default and now it's left as the only choice. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

This is a temporary fix for the time in which file "modules/mbedtls/configs/config-mbedtls-3.6.5.h" is still in the Zephyr codebase. This file is required because TF-M still builds using the old version of Mbed TLS which is v3.6.5. Once TF-M version will be bumped to 2.3 it will rely on TF-PSA-Crypto for its build and therefore this configuration file and this exception can be removed. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

These tests directly reference Mbed TLS/TF-PSA-Crypto include path in their CMakeLists file. This commits adjust the path with new values. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

TF-PSA-Crypto's bignum module includes some assembly optimization for x86, x86_64 and ARM64 platforms. When building for "native_sim/native" on a 64 bit platform the compiler tries to set 32 bit compatibility mode, but of course assembly functions between 32 and 64 bits architectures don't match and therefore the build fails. Disabling optimizations prevents TF-PSA-Crypto from trying to use assembly and the test passes. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

Remove legacy crypto configuration build symbols that are used in: mcux/middleware/wifi_nxp/incl/port/mbedtls/wpa_supp_dcp_mbedtls_config.h Signed-off-by: Valerio Setti <vsetti@baylibre.com>

sonarqubecloud · 2026-03-17T21:23:32Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
15.7% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions bot added manifest manifest-mbedtls-3.6.5 manifest-tf-psa-crypto manifest-mcuboot manifest-mbedtls DNM (manifest) This PR should not be merged (controlled by action-manifest) labels Feb 12, 2026

tomi-font self-requested a review February 13, 2026 07:12

valeriosetti force-pushed the mbedtls4-integration branch 3 times, most recently from ecc176b to 4ca507c Compare February 13, 2026 13:52

github-actions bot added manifest-tf-psa-crypto-framework manifest-mbedtls-framework labels Feb 13, 2026

valeriosetti force-pushed the mbedtls4-integration branch 2 times, most recently from d0ffe43 to 42b0f80 Compare February 13, 2026 23:16

valeriosetti mentioned this pull request Feb 14, 2026

Bump version to include a fix for Mbed TLS 4 zephyrproject-rtos/openthread#225

Merged

github-actions bot added the manifest-openthread label Feb 14, 2026

This was referenced Feb 16, 2026

Roadmap for bumping Mbed TLS 3.6 to Mbed TLS 4.0/TF-PSA-Crypto 1.0 #102005

Open

[mbedtls] add guard for error code that was removed in TF-PSA-Crypto 1.0 openthread/openthread#12459

Merged

valeriosetti force-pushed the mbedtls4-integration branch 3 times, most recently from 5aebdcb to c5e7c8c Compare February 17, 2026 12:01

github-actions bot added the manifest-uoscore-uedhoc label Feb 17, 2026

valeriosetti force-pushed the mbedtls4-integration branch 5 times, most recently from 42bdbeb to 7bbc1db Compare February 18, 2026 23:03

valeriosetti mentioned this pull request Feb 24, 2026

crypto: mbedtls_crypto_alt: replace legacy Mbed TLS crypto with PSA API and prepare for TF-PSA-Crypto 1.0 zephyrproject-rtos/hostap#125

Open

valeriosetti force-pushed the mbedtls4-integration branch from 6d91d3c to 2ea866b Compare February 24, 2026 14:57

tomi-font reviewed Mar 17, 2026

View reviewed changes

tejlmand requested changes Mar 17, 2026

View reviewed changes

valeriosetti added 23 commits March 18, 2026 06:03

MAINTAINERS: add entries for newly added Mbed TLS and TF-PSA-Crypto

3b64800

Add maintainers for "mbedtls-3.6" project. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

manifest: hostap: include fix for crypto usage

178cc70

Include a fix for replacing usage of legacy crypto with PSA Crypto API and to prepare for tf-psa-crypto transition. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

modules: mbedtls: remove deprecated build symbols

42e22a4

tf-psa-crypto deprecated usage of some build symbols and if they are still specified at build time the build will fail. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

modules: mbedtls: remove deprecated PSA_WANT symbols

c16046b

DES and elliptic curves secp192r1, secp192k1 and secp224r1 were removed from tf-psa-crypto. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

modules: tf-m: add interface headers to zephyr_interface library

6c21ea0

This allows NS app to have these headers available at build time without any need to extend its CMake file to explicitly link to "tfm_api" zephyr library. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

modules: hostap: remove legacy crypto Kconfig

e0eddd9

Select only PSA_WANT and remove usage of legacy crypto. Extend also Mbed TLS's CMake to build a library which includes legacy Mbed TLS crypto modules that were removed from TF-PSA-Crypto. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

net: lib: sockets: tls: do not specify random function to be used

c8ebaf1

Both PK and TLS now rely on PSA generate random to get random data so end users (i.e. sockets_tls in this case) don't need to manually specify this anymore. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

tests: adjust Mbed TLS header file path

c0948c9

These tests directly reference Mbed TLS/TF-PSA-Crypto include path in their CMakeLists file. This commits adjust the path with new values. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

manifest: nxp_hal: include a fix for Mbed TLS configuration header file

27795cb

Remove legacy crypto configuration build symbols that are used in: mcux/middleware/wifi_nxp/incl/port/mbedtls/wpa_supp_dcp_mbedtls_config.h Signed-off-by: Valerio Setti <vsetti@baylibre.com>

	# - it contains public header directories which are provided by Mbed TLS.
	# - it contains public include directories which are provided by Mbed TLS.


		endchoice # MBEDTLS_IMPLEMENTATION

		config TF_PSA_CRYPTO_CFG_FILE

	# Add Mbed TLS public header directories to the "mbedTLS" interface library.
	# Add Mbed TLS public include directories to the "mbedTLS" interface library.

	# Add another library to provide Zephyr support
	# Add another library to provide Zephyr-specific support

	zephyr_library_named(zephyr_mbedtls_support)
	zephyr_library()

		target_sources(builtin PRIVATE ${ZEPHYR_MBEDTLS_MODULE_DIR}/tf-psa-crypto/removed/dhm.c)
		target_sources(builtin PRIVATE ${ZEPHYR_MBEDTLS_MODULE_DIR}/tf-psa-crypto/removed/des.c)

Conversation

valeriosetti commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

valeriosetti Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sjanc commented Mar 17, 2026

Uh oh!

codecoup-tester commented Mar 17, 2026

Uh oh!

codecoup-tester commented Mar 17, 2026

valeriosetti commented Feb 12, 2026 •

edited

Loading

github-actions bot commented Feb 12, 2026 •

edited

Loading

valeriosetti Mar 17, 2026 •

edited

Loading