Merge "feat(st): use and override default MBedTLS config" into integration
diff --git a/plat/st/common/common.mk b/plat/st/common/common.mk
index 3624c65..0bedb72 100644
--- a/plat/st/common/common.mk
+++ b/plat/st/common/common.mk
@@ -201,16 +201,9 @@
TF_MBEDTLS_KEY_ALG := ecdsa
KEY_SIZE := 256
-ifneq (${MBEDTLS_DIR},)
-MBEDTLS_MAJOR=$(shell grep -hP "define MBEDTLS_VERSION_MAJOR" \
-${MBEDTLS_DIR}/include/mbedtls/*.h | grep -oe '\([0-9.]*\)')
+PLAT_INCLUDES += -Iinclude/drivers/auth/mbedtls
-ifeq (${MBEDTLS_MAJOR}, 3)
-MBEDTLS_CONFIG_FILE ?= "<stm32mp_mbedtls_config-3.h>"
-else
-$(error Error: TF-A only supports MbedTLS versions > 3.x)
-endif
-endif
+MBEDTLS_CONFIG_FILE ?= "<stm32mp_mbedtls_config.h>"
include drivers/auth/mbedtls/mbedtls_x509.mk
diff --git a/plat/st/common/include/stm32mp_mbedtls_config-3.h b/plat/st/common/include/stm32mp_mbedtls_config-3.h
deleted file mode 100644
index 2dbf068..0000000
--- a/plat/st/common/include/stm32mp_mbedtls_config-3.h
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * Copyright (c) 2022-2024, STMicroelectronics - All Rights Reserved
- *
- * SPDX-License-Identifier: BSD-3-Clause
- */
-
-/*
- * Key algorithms currently supported on mbed TLS libraries
- */
-#define TF_MBEDTLS_USE_RSA 0
-#define TF_MBEDTLS_USE_ECDSA 1
-
-/*
- * Hash algorithms currently supported on mbed TLS libraries
- */
-#define TF_MBEDTLS_SHA256 1
-#define TF_MBEDTLS_SHA384 2
-#define TF_MBEDTLS_SHA512 3
-
-/*
- * Configuration file to build mbed TLS with the required features for
- * Trusted Boot
- */
-
-#define MBEDTLS_PLATFORM_MEMORY
-#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
-/* Prevent mbed TLS from using snprintf so that it can use tf_snprintf. */
-#define MBEDTLS_PLATFORM_SNPRINTF_ALT
-
-#define MBEDTLS_PKCS1_V21
-
-#define MBEDTLS_ASN1_PARSE_C
-#define MBEDTLS_ASN1_WRITE_C
-
-#define MBEDTLS_BASE64_C
-#define MBEDTLS_BIGNUM_C
-
-#define MBEDTLS_ERROR_C
-#define MBEDTLS_MD_C
-
-#define MBEDTLS_MEMORY_BUFFER_ALLOC_C
-#define MBEDTLS_OID_C
-
-#define MBEDTLS_PK_C
-#define MBEDTLS_PK_PARSE_C
-#define MBEDTLS_PK_WRITE_C
-
-#define MBEDTLS_PLATFORM_C
-
-#if TF_MBEDTLS_USE_ECDSA
-#define MBEDTLS_ECDSA_C
-#define MBEDTLS_ECP_C
-#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
-#endif
-#if TF_MBEDTLS_USE_RSA
-#define MBEDTLS_RSA_C
-#define MBEDTLS_X509_RSASSA_PSS_SUPPORT
-#endif
-
-/* The library does not currently support enabling SHA-256 without SHA-224. */
-#define MBEDTLS_SHA224_C
-#define MBEDTLS_SHA256_C
-
-#if (TF_MBEDTLS_HASH_ALG_ID != TF_MBEDTLS_SHA256)
-#define MBEDTLS_SHA384_C
-#define MBEDTLS_SHA512_C
-#endif
-
-#define MBEDTLS_VERSION_C
-
-#define MBEDTLS_X509_USE_C
-#define MBEDTLS_X509_CRT_PARSE_C
-
-#if TF_MBEDTLS_USE_AES_GCM
-#define MBEDTLS_AES_C
-#define MBEDTLS_CIPHER_C
-#define MBEDTLS_GCM_C
-#endif
-
-/* MPI / BIGNUM options */
-#define MBEDTLS_MPI_WINDOW_SIZE 2
-
-#if TF_MBEDTLS_USE_RSA
-#if TF_MBEDTLS_KEY_SIZE <= 2048
-#define MBEDTLS_MPI_MAX_SIZE 256
-#else
-#define MBEDTLS_MPI_MAX_SIZE 512
-#endif
-#else
-#define MBEDTLS_MPI_MAX_SIZE 256
-#endif
-
-/* Memory buffer allocator options */
-#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 8
-
-/*
- * Prevent the use of 128-bit division which
- * creates dependency on external libraries.
- */
-#define MBEDTLS_NO_UDBL_DIVISION
-
-#ifndef __ASSEMBLER__
-/* System headers required to build mbed TLS with the current configuration */
-#include <stdlib.h>
-#endif
-
-/*
- * Mbed TLS heap size is smal as we only use the asn1
- * parsing functions
- * digest, signature and crypto algorithm are done by
- * other library.
- */
-
-#define TF_MBEDTLS_HEAP_SIZE U(5120)
diff --git a/plat/st/common/include/stm32mp_mbedtls_config.h b/plat/st/common/include/stm32mp_mbedtls_config.h
new file mode 100644
index 0000000..d6a4cc3
--- /dev/null
+++ b/plat/st/common/include/stm32mp_mbedtls_config.h
@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2025, STMicroelectronics - All Rights Reserved
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <default_mbedtls_config.h>
+
+/* MPI / BIGNUM options */
+#undef MBEDTLS_MPI_WINDOW_SIZE
+#define MBEDTLS_MPI_WINDOW_SIZE 2
+
+/*
+ * Mbed TLS heap size is small as we only use the asn1
+ * parsing functions
+ * digest, signature and crypto algorithm are done by
+ * other library.
+ */
+#undef TF_MBEDTLS_HEAP_SIZE
+#define TF_MBEDTLS_HEAP_SIZE U(5120)