Update mbedtls, lwip and cyw43-driver (#2405)

* Update LwIP to 2.2.1
* Update to mbedtls to 3.6.1
* Update lib/cyw43-driver to 1.1.0
* Support using a more recent version of mbedtls
altcp_tls_mbedtls.c is not compatible with mbedtls 3.x so use a
patched version until this is resolved.
* Make sure MBEDTLS_VERSION_MAJOR is visible to LwIP.
* Test mbedtls in kitchen sink
* Add mbedtls to bazel

Author: peterharperuk

.github/workflows/cmake.yml

@@ -26,7 +26,7 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Checkout submodules
-      run: git submodule update --init
+      run: git submodule update --init --recursive
 
     - name: Create Build Environment
       # Some projects don't allow in-source building, so create a separate build directory

MODULE.bazel

@@ -106,18 +106,25 @@ new_git_repository(
 new_git_repository(
     name = "cyw43-driver",
     build_file = "//src/rp2_common/pico_cyw43_driver:cyw43-driver.BUILD",
-    commit = "c1075d4bc440422cf2b2fd12c64a1f53f77660ee",  # keep-in-sync-with-submodule: lib/cyw43-driver
+    commit = "dd7568229f3bf7a37737b9e1ef250c26efe75b23",  # keep-in-sync-with-submodule: lib/cyw43-driver
     remote = "https://github.com/georgerobotics/cyw43-driver.git",
 )
 
 # TODO: Provide lwip as a proper Bazel module.
 new_git_repository(
     name = "lwip",
     build_file = "//src/rp2_common/pico_lwip:lwip.BUILD",
-    commit = "0a0452b2c39bdd91e252aef045c115f88f6ca773",  # keep-in-sync-with-submodule: lib/lwip
+    commit = "77dcd25a72509eb83f72b033d219b1d40cd8eb95",  # keep-in-sync-with-submodule: lib/lwip
     remote = "https://github.com/lwip-tcpip/lwip.git",
 )
 
+new_git_repository(
+    name = "mbedtls",
+    build_file = "//src/rp2_common/pico_mbedtls:mbedtls.BUILD",
+    commit = "107ea89daaefb9867ea9121002fbbdf926780e98",  # keep-in-sync-with-submodule: lib/mbedtls
+    remote = "https://github.com/Mbed-TLS/mbedtls.git",
+)
+
 register_toolchains(
     "//bazel/toolchain:linux-aarch64-rp2040",
     "//bazel/toolchain:linux-aarch64-rp2350",

bazel/config/BUILD.bazel

@@ -294,3 +294,9 @@ label_flag(
     name = "PICO_FREERTOS_LIB",
     build_setting_default = "//bazel:empty_cc_lib",
 )
+
+# PICO_BAZEL_CONFIG: PICO_MBEDTL_CONFIG, [Bazel only] The cc_library that provides mbedtls_config.h, default=//bazel:empty_cc_lib, group=pico_mbedtls
+label_flag(
+    name = "PICO_MBEDTLS_CONFIG",
+    build_setting_default = "//bazel:empty_cc_lib",
+)

bazel/constraint/BUILD.bazel

@@ -252,3 +252,9 @@ label_flag_matches(
     flag = "//bazel/config:PICO_FREERTOS_LIB",
     value = "//bazel:empty_cc_lib",
 )
+
+label_flag_matches(
+    name = "pico_mbedtls_config_unset",
+    flag = "//bazel/config:PICO_MBEDTLS_CONFIG",
+    value = "//bazel:empty_cc_lib",
+)

bazel/util/transition.bzl

@@ -114,6 +114,7 @@ kitchen_sink_test_binary = declare_transtion(
     attrs = {
         "bt_stack_config": attr.label(mandatory = True),
         "lwip_config": attr.label(mandatory = True),
+        "mbedtls_config": attr.label(mandatory = True),
         "enable_ble": attr.bool(default = False),
         "enable_bt_classic": attr.bool(default = False),
         # This could be shared, but we don't in order to make it clearer that
@@ -127,6 +128,7 @@ kitchen_sink_test_binary = declare_transtion(
         "@pico-sdk//bazel/config:PICO_LWIP_CONFIG": "lwip_config",
         "@pico-sdk//bazel/config:PICO_BT_ENABLE_BLE": "enable_ble",
         "@pico-sdk//bazel/config:PICO_BT_ENABLE_CLASSIC": "enable_bt_classic",
+        "@pico-sdk//bazel/config:PICO_MBEDTLS_CONFIG": "mbedtls_config",
     },
 )
 

docs/index.h

@@ -80,6 +80,7 @@
  * \defgroup tinyusb_device tinyusb_device
  * \defgroup tinyusb_host tinyusb_host
  * \endcond
+ * \cond pico_mbedtls \defgroup pico_mbedtls pico_mbedtls \endcond
  * @}
  *
  * \defgroup networking Networking Libraries

lib/cyw43-driver

@@ -127,9 +127,9 @@ if (NOT PICO_BARE_METAL)
     pico_add_subdirectory(rp2_common/pico_async_context)
     pico_add_subdirectory(rp2_common/pico_btstack)
     pico_add_subdirectory(rp2_common/pico_cyw43_driver)
+    pico_add_subdirectory(rp2_common/pico_mbedtls)
     pico_add_subdirectory(rp2_common/pico_lwip)
     pico_add_subdirectory(rp2_common/pico_cyw43_arch)
-    pico_add_subdirectory(rp2_common/pico_mbedtls)
 
     pico_add_subdirectory(rp2_common/pico_time_adapter)
 

lib/lwip

@@ -1,3 +1,4 @@
+# PICO_CMAKE_CONFIG: PICO_BTSTACK_PATH, Path to an alternative version of btstack overriding the version in pico-sdk/libs/btstack. Can be passed to cmake or set in your environment, type=string, group=pico_btstack
 if (DEFINED ENV{PICO_BTSTACK_PATH} AND (NOT PICO_BTSTACK_PATH))
     set(PICO_BTSTACK_PATH $ENV{PICO_BTSTACK_PATH})
     message("Using PICO_BTSTACK_PATH from environment ('${PICO_BTSTACK_PATH}')")

lib/mbedtls

@@ -1,3 +1,4 @@
+# PICO_CMAKE_CONFIG: PICO_CYW43_DRIVER_PATH, Path to an alternative version of cyw43-driver overriding the version in pico-sdk/libs/cyw43-driver, type=string, group=pico_cyw43_driver
 if (DEFINED ENV{PICO_CYW43_DRIVER_PATH} AND (NOT PICO_CYW43_DRIVER_PATH))
     set(PICO_CYW43_DRIVER_PATH $ENV{PICO_CYW43_DRIVER_PATH})
     message("Using PICO_CYW43_DRIVER_PATH from environment ('${PICO_CYW43_DRIVER_PATH}')")

src/cmake/rp2_common.cmake

@@ -131,14 +131,15 @@ alias(
     actual = "@lwip//:pico_lwip_tftp",
 )
 
-alias(
+cc_library(
     name = "pico_lwip_mbedtls",
-    actual = "@lwip//:pico_lwip_mbedtls",
+    srcs = ["altcp_tls_mbedtls.c"],
+    deps = ["@lwip//:pico_lwip_mbedtls"],
 )
 
 alias(
-    name = "pico_lwip_mqttt",
-    actual = "@lwip//:pico_lwip_mqttt",
+    name = "pico_lwip_mqtt",
+    actual = "@lwip//:pico_lwip_mqtt",
 )
 
 alias(

src/rp2_common/pico_btstack/CMakeLists.txt

@@ -1,3 +1,4 @@
+# PICO_CMAKE_CONFIG: PICO_LWIP_PATH, Path to an alternative version of lwip overriding the version in pico-sdk/libs/lwip. Can be passed to cmake or set in your environment, type=string, group=pico_lwip
 if (DEFINED ENV{PICO_LWIP_PATH} AND (NOT PICO_LWIP_PATH))
     set(PICO_LWIP_PATH $ENV{PICO_LWIP_PATH})
     message("Using PICO_LWIP_PATH from environment ('${PICO_LWIP_PATH}')")
@@ -234,14 +235,29 @@ if (EXISTS ${PICO_LWIP_PATH}/${LWIP_TEST_PATH})
             ${PICO_LWIP_PATH}/src/apps/tftp/tftp.c
             )
 
+
     # Mbed TLS files
     pico_add_library(pico_lwip_mbedtls NOFLAG)
     target_sources(pico_lwip_mbedtls INTERFACE
-            ${PICO_LWIP_PATH}/src/apps/altcp_tls/altcp_tls_mbedtls.c
             ${PICO_LWIP_PATH}/src/apps/altcp_tls/altcp_tls_mbedtls_mem.c
             ${PICO_LWIP_PATH}/src/apps/snmp/snmpv3_mbedtls.c
             )
 
+    # altcp_tls_mbedtls.c is not compatible with mbedtls 3.x so use a patched version until this is resolved
+    # See https://savannah.nongnu.org/patch/index.php?10448
+    if (MBEDTLS_VERSION_MAJOR AND MBEDTLS_VERSION_MAJOR GREATER_EQUAL  3)
+        target_sources(pico_lwip_mbedtls INTERFACE
+            ${CMAKE_CURRENT_LIST_DIR}/altcp_tls_mbedtls.c
+            )
+        target_include_directories(pico_lwip_mbedtls INTERFACE
+            ${PICO_LWIP_PATH}/src/apps/altcp_tls
+            )
+    else()
+        target_sources(pico_lwip_mbedtls INTERFACE
+            ${PICO_LWIP_PATH}/src/apps/altcp_tls/altcp_tls_mbedtls.c
+            )
+    endif()
+
     # MQTT client files
     pico_add_library(pico_lwip_mqtt NOFLAG)
     target_sources(pico_lwip_mqtt INTERFACE