Bump to v3.6.5 #79

valeriosetti · 2025-10-21T09:29:51Z

Proposed bump strategy

Full details are in #78 in this document.

Preparation for this PR

I created a new branch named zephyr_mbedtls_v.3.6.5 and pushed it to this repo.

It is located at the upstream v3.6.5 release tag.
Its purpose it contain all the Zephyr custom patches.
It will be the default branch of this repo until the next Mbed TLS release.

This approach has already been tried before for version bumping in TF-M.

What's done in this PR

I cherry-picked all the Zephyr's custom commits from the current zephyr branch and created this PR. Please note that the target merging branch is the above mentioned zephyr_mbedtls_v3.6.5, that's why you will only see relatively few commits in this version bumping PR.

Following a suggestion from @tomi-font I also moved all the [fromtree/fromlist] patches at the beginning of the list and kept all the others [noup] later.

tomi-font

Indeed with this strategy the GitHub interface doesn't play out too well. It would look prettier if the base branch (in this case) was based on 3.6.5 instead, in which case in this PR we would only see the additional Zephyr-specific patches on top of 3.6.5.

But if doing what I just said, after merging update PRs we would probably need to move branches, for example replacing the default branch with the one that was just updated.

I think in any case this requires some manual force push.
Unless if we did for every release a new branch and that we stuck to it (without renaming it) until the next release, but in that case we wouldn't necessarily know what is the current living branch. At the very least we would probably need to mark it as the default branch so that it's the branch that show up by default in GitHub.

… static key slots Take also MAC's key types into account when computing the size of the buffer to store key material in static key slot configuration. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no> (cherry picked from commit 45574797e7c66dcd99cfeb0e0be5feb291271d1a)

…_STATIC_KEY_SLOT_BUFFER_SIZE Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no> (cherry picked from commit 5306324015b9db29969dff1ba592f6675a6dedf5)

tomi-font

Following commits are fromtrees:

[zep noup] zephyr: Bump security SBOM info now doesn't just bump the info, it adds it. So update the commit title?
[zep noup] zephyr/module.yml: add module name could be combined and squashed with the previous commit I mentioned?

[zep noup] Avoid invalid gcc 14.3 warning about array bounds in mbedtls_xor was a fromlist, and can now be a fromtree.

valeriosetti · 2025-10-28T14:07:12Z

Following commits are fromtrees:

* [[zep noup] fix: remove superfluous BEFORE_COLON in x509_crl.c](https://github.com/zephyrproject-rtos/mbedtls/pull/79/commits/8177a5a714e9d449f1fc7a6f883a708084eaba01)

* [[zep noup] fix: rename BEFORE_COLON and BC to avoid conflicts](https://github.com/zephyrproject-rtos/mbedtls/pull/79/commits/5d9cbecb952b2a303ab059f6f9b5aed573fc357a)

Unless I'm missing something, these commits were cherry-picked from this repo and not from the upstream one (I cannot find them upstream) so they are still noup. Can you please double check?

[zep noup] zephyr: Bump security SBOM info now doesn't just bump the info, it adds it. So update the commit title? [zep noup] zephyr/module.yml: add module name could be combined and squashed with the previous commit I mentioned?

Sure I'll do

[zep noup] Avoid invalid gcc 14.3 warning about array bounds in mbedtls_xor was a fromlist, and can now be a fromtree.

~~Mmmmm I need to figure out why git didn't realize that this commit is already in the 3.6.5 release.~~ Thanks for the heads up!
Edit: Looking at the history of the upstream branch it turns out that this fix was merged after the 3.6.5 tag, so we still need to keep this extra commit as Zephyr patch, but as you mentioned it's a fromtree now.

…bedtls_xor The combination of the multi-byte loop with the single byte loop confuses GCC 14.3's array bounds checker. When the loop size is constant, check to see if it is a multiple of the multi-byte size and bail early. As this will be evaluated at compile time, there should be no run-time cost. This change uses the __builtin_constant_p compile-time operation. To check if that is supported, the change uses the existing MBEDTLS_HAS_BUILTIN macro. That macro was defined later in library/common.h than is needed for this change, so it was moved up to join some other macros that looked similar. Signed-off-by: Keith Packard <keithp@keithp.com> (cherry picked from commit 292b96c0a69016a6d99ce324837a9e96d59e21f6)

tomi-font · 2025-10-29T06:34:07Z

Unless I'm missing something, these commits were cherry-picked from this repo and not from the upstream one (I cannot find them upstream) so they are still noup. Can you please double check?

No, they were cherry picked from upstream, the hashes in their commit messages point to upstream:

valeriosetti · 2025-10-29T07:49:48Z

Unless I'm missing something, these commits were cherry-picked from this repo and not from the upstream one (I cannot find them upstream) so they are still noup. Can you please double check?

No, they were cherry picked from upstream, the hashes in their commit messages point to upstream:
* [Mbed-TLS/mbedtls@6a9cf11](https://github.com/Mbed-TLS/mbedtls/commit/6a9cf113611de1d8ac18f49563883a639ae7c7d6)

* [Mbed-TLS/mbedtls@b5c079b](https://github.com/Mbed-TLS/mbedtls/commit/b5c079b13c4977bdba8593d174d7851e41b5788e)

I found the reason for which I didn't find those commits upstream: because they were merged on development branch and not backported to mbedtls-3.6 LTS one. I think they should have been also backported, otherwise technically they are not fromtree since they will never appear on the mbedtls-3.6 branch.
Since we're planning to transition to 4.0 soon anyway and the patch applies cleanly I can live with this. I will update the tag.

tomi-font · 2025-10-29T07:52:13Z

I found the reason for which I didn't find those commits upstream: because they were merged on development branch and not backported to mbedtls-3.6 LTS one. I think they should have been also backported, otherwise technically they are not fromtree since they will never appear on the mbedtls-3.6 branch.

Right. I would argue it's still a fromtree: it comes from upstream, even though it's not strictly on the branch we are currently following.

tomi-font

Remove (cherry picked from commit [...]) from [zep noup] Enable sources when MCUBOOT_USE_PSA_CRYPTO and not MBEDTLS_PSA_CRYPTO_C as well for consistency.
Update commit [zep noup] zephyr: Add security SBOM info and add module name: Remove second add in title and replace Change with Add in message?
Can you also move the fromtrees to be the first commits? will be cleaner that way

BEFORE_COLON and BC defines with the accompanying comment are only required in x509_crt and x509_csr, but not used in x509_crl.c. Signed-off-by: Stefan Gloor <stefan.gloor@siemens.com> (cherry picked from commit 6a9cf11)

Namespace BEFORE_COLON and BC defines by prepending MBEDTLS_ and expanding BC to BEFORE_COLON_STR. This is to avoid naming conflicts with third-party code. No functional change. Signed-off-by: Stefan Gloor <stefan.gloor@siemens.com> (cherry picked from commit b5c079b)

TF-M requires a mechanism to leverage the drivers and builtin keys at the same time to allow for "transparent builtin keys". More details are in the TF-M design doc. Provide directly the wrappers instead of modifying the autogen scripts, for the time being. Signed-off-by: Raef Coles <raef.coles@arm.com> Co-authored-by: Antonio de Angelis <antonio.deangelis@arm.com> applied using: git am modules/tee/tf-m/trusted-firmware-m/lib/ext/mbedcrypto/\ 0001-Add-TF-M-Builtin-Key-Loader-driver-entry-points.patch Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

Signed-off-by: Tamas Ban <tamas.ban@arm.com> applied using: git am modules/tee/tf-m/trusted-firmware-m/lib/ext/mbedcrypto/\ 0002-Enable-crypto-code-sharing-between-independent-binar.patch Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

Signed-off-by: Benjamin Baratte <benjamin.baratte@st.com> applied using: git am modules/tee/tf-m/trusted-firmware-m/lib/ext/mbedcrypto/\ 0003-Allow-SE-key-to-use-key-vendor-id-within-PSA-crypto.patch Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

This patch amends the order of initialisations performed in psa_crypto_init() to make sure that the driver wrappers based on the PSA driver API are initialised just after the key slots in memory, both of them at the beginning of the initialisation sequence. Signed-off-by: Antonio de Angelis <antonio.deangelis@arm.com> applied using: git am modules/tee/tf-m/trusted-firmware-m/lib/ext/mbedcrypto/\ 0004-Initialise-driver-wrappers-as-first-step-in-psa_cryp.patch Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

Manually hardcode PSA driver entry points for the CC3XX driver into psa crypto driver wrappers file (and provide missing entry point definitions if any). This is a temporary solution until the codegen framework is available for automatic integration. Signed-off-by: Antonio de Angelis <antonio.deangelis@arm.com> applied using: git am modules/tee/tf-m/trusted-firmware-m/lib/ext/mbedcrypto/\ 0005-Hardcode-CC3XX-entry-points.patch Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

CC312 driver want to use hash in md for entropy operations. Enable psa_can_do_hash by directly returning 1. This is a workaround for current cc312 driver. After switching to new driver, this workaround is not needed. Signed-off-by: Summer Qin <summer.qin@arm.com> applied using: git am modules/tee/tf-m/trusted-firmware-m/lib/ext/mbedcrypto/\ 0006-Enable-psa_can_do_hash.patch Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

…_PSA_CRYPTO_C Gate relevant files for the thin PSA crypto core on MCUBOOT_USE_PSA_CRYPTO during BL2 build instead of MBEDTLS_PSA_CRYPTO_C which is not defined in such case. A full solution might require a change in config strategy of Mbed TLS with the definition Signed-off-by: Antonio de Angelis <antonio.deangelis@arm.com> applied using: git am modules/tee/tf-m/trusted-firmware-m/lib/ext/mbedcrypto/\ 0007-Enable-sources-when-MCUBOOT_USE_PSA_CRYPTO-and-not-M.patch Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

MCUboot has its own version of the PSA Crypto core, named "thin_psa_crypto_core.c" which is included in MCUboot's build process when the MCUBOOT_USE_PSA_CRYPTO build symbol is set. MCUBOOT_USE_PSA_CRYPTO mimics what MBEDTLS_PSA_CRYPTO_C does for the official Mbed TLS, so we need to replicate this symbol in "config_psa.h" in order to get the proper PSA builtin support. Signed-off-by: Valerio Setti <vsetti@baylibre.com>

Add PURL and CPE information in the module package for 3.6.5. The module name is now explicitly set in module.yml, this ensures that building with e.g. cmake does not fail when the directory name is different (default name if unset is directory name). Signed-off-by: Valerio Setti <vsetti@baylibre.com>

Zephyr uses cmake 3.20.0 as the minimum version for a long time. Set the same requirement here to avoid possible issues in future. Fixes zephyrproject-rtos/zephyr#92679 Signed-off-by: Flavio Ceolin <flavio@hubblenetwork.com> Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

Here's the procedure that has been followed. Starting from the upstream v3.6.5 tag I run: $ git submodule init $ git submodule update The checked out version of framework subrepo is 457996474728cb8e968ed21953b72f74d2f536b2 which corresponds to the upstream one at the v3.6.5 tag. I then run: $ git rm --cached framework $ rm -rf .git/modules/framework $ rm -rf framework/.git* Signed-off-by: Valerio Setti <vsetti@baylibre.com>

Re-add the content of the framework subrepo Signed-off-by: Valerio Setti <vsetti@baylibre.com>

tomi-font

Perfect, just pending cherry-picking the readme changes once #78 is approved/merged.

Replace the upstream README with guidelines for the additional patches. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

valeriosetti requested review from ceolin, d3zd3z, dleach02, ithinuel, tbursztyka, tomi-font and wearyzen and removed request for tbursztyka October 21, 2025 09:30

tomi-font reviewed Oct 24, 2025

View reviewed changes

valeriosetti force-pushed the zephyr-mbedtls-3.6 branch 2 times, most recently from e224037 to 99aca8b Compare October 28, 2025 09:50

valeriosetti added 2 commits October 28, 2025 10:51

[zep fromtree] psa: crypto_extra: update documentation of MBEDTLS_PSA…

16659ea

…_STATIC_KEY_SLOT_BUFFER_SIZE Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no> (cherry picked from commit 5306324015b9db29969dff1ba592f6675a6dedf5)

valeriosetti force-pushed the bump-v3.6.5 branch from b1471eb to 9ed933f Compare October 28, 2025 09:58

tomi-font requested changes Oct 28, 2025

View reviewed changes

valeriosetti changed the base branch from zephyr-mbedtls-3.6 to zephyr-mbedtls-v3.6.5 October 28, 2025 10:52

valeriosetti requested a review from tomi-font October 28, 2025 15:38

valeriosetti force-pushed the bump-v3.6.5 branch from 9ed933f to 4529718 Compare October 28, 2025 15:57

valeriosetti mentioned this pull request Oct 28, 2025

doc: extend README explaining how version bumping should be handled #78

Open

valeriosetti force-pushed the bump-v3.6.5 branch from 4529718 to 50557cb Compare October 29, 2025 07:52

tomi-font requested changes Oct 29, 2025

View reviewed changes

stgloorious and others added 4 commits October 29, 2025 09:09

BenBaratte and others added 10 commits October 29, 2025 09:09

[zep noup] Add framework subrepo as a flattened directory

622da34

Re-add the content of the framework subrepo Signed-off-by: Valerio Setti <vsetti@baylibre.com>

valeriosetti force-pushed the bump-v3.6.5 branch from 50557cb to 622da34 Compare October 29, 2025 08:09

valeriosetti changed the base branch from zephyr-mbedtls-v3.6.5 to zephyr_mbedtls_v3.6.5 October 29, 2025 12:20

valeriosetti requested a review from tomi-font October 31, 2025 09:24

tomi-font approved these changes Oct 31, 2025

View reviewed changes

valeriosetti changed the title ~~Version bump example: bump to v3.6.5~~ Bump to v3.6.5 Nov 3, 2025

valeriosetti mentioned this pull request Nov 3, 2025

manifest: mbedtls: bump to 3.6.5 zephyrproject-rtos/zephyr#98786

Merged

ceolin approved these changes Nov 4, 2025

View reviewed changes

[zep noup] document the additional patches

be094cd

Replace the upstream README with guidelines for the additional patches. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

tomi-font approved these changes Nov 6, 2025

View reviewed changes

tomi-font merged commit c5b06d8 into zephyrproject-rtos:zephyr_mbedtls_v3.6.5 Nov 6, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump to v3.6.5 #79

Bump to v3.6.5 #79

Uh oh!

valeriosetti commented Oct 21, 2025 •

edited

Loading

Uh oh!

tomi-font left a comment

Uh oh!

tomi-font left a comment

Uh oh!

valeriosetti commented Oct 28, 2025 •

edited

Loading

Uh oh!

tomi-font commented Oct 29, 2025

Uh oh!

valeriosetti commented Oct 29, 2025

Uh oh!

tomi-font commented Oct 29, 2025

Uh oh!

tomi-font left a comment

Uh oh!

tomi-font left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Bump to v3.6.5 #79

Bump to v3.6.5 #79

Uh oh!

Conversation

valeriosetti commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed bump strategy

Preparation for this PR

What's done in this PR

Uh oh!

tomi-font left a comment

Choose a reason for hiding this comment

Uh oh!

tomi-font left a comment

Choose a reason for hiding this comment

Uh oh!

valeriosetti commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tomi-font commented Oct 29, 2025

Uh oh!

valeriosetti commented Oct 29, 2025

Uh oh!

tomi-font commented Oct 29, 2025

Uh oh!

tomi-font left a comment

Choose a reason for hiding this comment

Uh oh!

tomi-font left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

valeriosetti commented Oct 21, 2025 •

edited

Loading

valeriosetti commented Oct 28, 2025 •

edited

Loading