# Cryptography primitive options for mbed TLS

# Copyright (c) 2016 Intel Corporation
# SPDX-License-Identifier: Apache-2.0

config ZEPHYR_MBEDTLS_MODULE
	bool

config MBEDTLS_PROMPTLESS
	bool
	help
	  Symbol to disable the prompt for MBEDTLS selection.
	  This symbol may be used internally in a Kconfig tree to hide the
	  mbed TLS menu prompt and instead handle the selection of MBEDTLS from
	  dependent sub-configurations and thus prevent stuck symbol behavior.

config MBEDTLS_VERSION_4_x
	bool
	default y
	help
	  Hidden Kconfig symbol used internally to mark support for Mbed TLS 4.x.

config TF_PSA_CRYPTO_MODULE_DIR
	string
	default "${ZEPHYR_TF_PSA_CRYPTO_MODULE_DIR}"

rsource "Kconfig.psa.auto"
rsource "Kconfig.psa.logic"

menuconfig MBEDTLS
	bool "mbed TLS Support" if !MBEDTLS_PROMPTLESS
	depends on PSA_CRYPTO
	help
	  This option enables the Mbed TLS cryptography library.

if MBEDTLS

choice MBEDTLS_IMPLEMENTATION
	prompt "Mbed TLS implementation"
	default MBEDTLS_BUILTIN

config MBEDTLS_BUILTIN
	bool "Zephyr in-tree Mbed TLS version"
	help
	  Link with Mbed TLS sources included with Zephyr distribution.
	  Included Mbed TLS version is well integrated with and supported
	  by Zephyr, and the recommended choice for most users.

config MBEDTLS_CUSTOM
	bool "Custom Mbed TLS library"
	help
	  The Mbed TLS library must be configured and added out of tree.

endchoice # MBEDTLS_IMPLEMENTATION

choice TF_PSA_CRYPTO_IMPLEMENTATION
	prompt "TF-PSA-Crypto implementation"
	default TF_PSA_CRYPTO_BUILTIN

config TF_PSA_CRYPTO_BUILTIN
	bool "Zephyr in-tree TF-PSA-Crypto version"
	help
	  Link with TF-PSA-Crypto sources included with Zephyr distribution.
	  Included TF-PSA-Crypto version is well integrated with and supported
	  by Zephyr, and the recommended choice for most users.

config TF_PSA_CRYPTO_CUSTOM
	bool "Custom TF-PSA-Crypto library"
	help
	  The TF-PSA-Crypto library must be configured and added out of tree.
	  If using MBEDTLS_BUILTIN with this option TF-PSA-Crypto won't be added and built
	  by Mbed TLS but Mbed TLS will still expect a tfpsacrypto CMake library to exist.
	  Zephyr itself won't create or use the tfpsacrypto CMake library but you are expected to provide it for the CMake of Mbed TLS.

endchoice # TF_PSA_CRYPTO_IMPLEMENTATION

rsource "Kconfig.mbedtls"
rsource "Kconfig.tf-psa-crypto"
rsource "Kconfig.ciphersuites"
rsource "Kconfig.deprecated"

config MBEDTLS_DEBUG
	bool "mbed TLS debug activation"
	imply MBEDTLS_DEBUG_C
	help
	  Enable debugging activation for mbed TLS configuration. If you use
	  Mbed TLS/Zephyr integration (e.g. native TLS sockets), this will
	  activate debug logging.

	  If you use Mbed TLS directly instead, you will need to perform
	  additional configuration yourself: call
	  mbedtls_ssl_conf_dbg(&mbedtls.conf, zephyr_mbedtls_debug, NULL);
	  function in your application. Alternatively implement your own debug
	  hook function if zephyr_mbedtls_debug() doesn't suit your needs.

if MBEDTLS_DEBUG

module = MBEDTLS
module-str = Log level Mbed TLS library debug hook
source "subsys/logging/Kconfig.template.log_config"

config MBEDTLS_DEBUG_LEVEL
	int
	default 4 if MBEDTLS_LOG_LEVEL_DBG
	default 3 if MBEDTLS_LOG_LEVEL_INF
	default 2 if MBEDTLS_LOG_LEVEL_WRN
	default 1 if MBEDTLS_LOG_LEVEL_ERR
	default 0
	range 0 4
	help
	  Default mbed TLS debug logging level for Zephyr integration code
	  (from ext/lib/crypto/mbedtls/include/mbedtls/debug.h):
	  0 No debug
	  1 Error
	  2 State change
	  3 Information
	  4 Verbose

	  This makes Zephyr call mbedtls_debug_set_threshold() function during
	  Mbed TLS initialization, with the configured debug log level.

choice MBEDTLS_DEBUG_EXTRACT_BASENAME
	prompt "Extract basename from filenames"
	default MBEDTLS_DEBUG_EXTRACT_BASENAME_AT_BUILDTIME if "$(ZEPHYR_TOOLCHAIN_VARIANT)" = "zephyr"
	default MBEDTLS_DEBUG_EXTRACT_BASENAME_AT_RUNTIME

config MBEDTLS_DEBUG_EXTRACT_BASENAME_AT_BUILDTIME
	bool "Buildtime"
	help
	  Adds compile options, which should convert full source paths in
	  __FILE__ macro to files' basenames. This will reduce code footprint
	  when debug messages are enabled.

	  This is compiler dependent, so if it does not work then please
	  fallback to MBEDTLS_DEBUG_EXTRACT_BASENAME_AT_RUNTIME instead.

config MBEDTLS_DEBUG_EXTRACT_BASENAME_AT_RUNTIME
	bool "Runtime"
	help
	  Filename passed as argument to debug hook will be stripped from
	  directory, so that only basename part is left and logged.

config MBEDTLS_DEBUG_EXTRACT_BASENAME_DISABLED
	bool "Disabled"
	help
	  Disable basename extraction from filenames in log mesasges. This will
	  result in full paths or paths relative to west root directory
	  appearing in log messages generated by Mbed TLS library.

endchoice # MBEDTLS_DEBUG_EXTRACT_BASENAME

config MBEDTLS_DEBUG_STRIP_NEWLINE
	bool "Strip newlines"
	default y
	help
	  Attempt to strip last character from logged string when it is a
	  newline.

endif # MBEDTLS_DEBUG

config MBEDTLS_INIT
	bool "Initialize mbed TLS at boot"
	default y
	help
	  By default mbed TLS will be initialized at Zephyr init. Disabling this option
	  will defer the initialization until explicitly called.

config MBEDTLS_SHELL
	bool "mbed TLS shell"
	depends on SHELL
	help
	  Enable mbed TLS shell module, which allows to show debug information
	  about mbed TLS library, such as heap usage.

config APP_LINK_WITH_MBEDTLS
	bool "Link 'app' with MBEDTLS"
	depends on MBEDTLS_BUILTIN
	default y
	help
	  Add MBEDTLS header files to the 'app' include path. It may be
	  disabled if the include paths for MBEDTLS are causing aliasing
	  issues for 'app'.

endif # MBEDTLS
