Skip to content

stm32: allow excluding mbedTLS to fit flash-constrained stm32g474ret6 #2367

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bettio merged 1 commit into from
Jul 19, 2026
+17 −1
Merged

stm32: allow excluding mbedTLS to fit flash-constrained stm32g474ret6 #2367

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .github/workflows/stm32-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,9 @@ jobs:
tests: "boot gpio i2c spi crypto uart"
- device: stm32g474ret6
max_size: 393216
# 384 KB flash: exclude mbedTLS/crypto (~38 KB) to fit the whole
# firmware. G474 has an RNG, so crypto is opt-out via the flag.
disable-crypto: "ON"
- device: stm32l476rgt6
max_size: 524288
- device: stm32l562qei6
Expand Down Expand Up @@ -166,7 +169,7 @@ jobs:
set -euo pipefail
mkdir build
cd build
cmake .. -G Ninja -DCMAKE_TOOLCHAIN_FILE=cmake/arm-toolchain.cmake -DDEVICE=${{ matrix.device }} ${{ matrix.usb-cdc == 'ON' && '-DAVM_USB_CDC_PORT_DRIVER_ENABLED=ON' || '' }}
cmake .. -G Ninja -DCMAKE_TOOLCHAIN_FILE=cmake/arm-toolchain.cmake -DDEVICE=${{ matrix.device }} ${{ matrix.usb-cdc == 'ON' && '-DAVM_USB_CDC_PORT_DRIVER_ENABLED=ON' || '' }} ${{ matrix.disable-crypto == 'ON' && '-DAVM_DISABLE_MBEDTLS=ON' || '' }}
cmake --build .

- name: "Perform CodeQL Analysis"
Expand Down
1 change: 1 addition & 0 deletions src/platforms/stm32/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ option(AVM_ENABLE_LOG_LINES "Include source and line info for all enabled levels
option(AVM_CONFIG_REBOOT_ON_NOT_OK "Reboot when application exits with non 'ok' return" OFF)
option(AVM_DISABLE_GPIO_NIFS "Disable GPIO nifs (input and output)" OFF)
option(AVM_DISABLE_GPIO_PORT_DRIVER "Disable GPIO 'port' driver (input, output, and interrupts)" OFF)
option(AVM_DISABLE_MBEDTLS "Exclude mbedTLS/crypto NIFs even on devices with an RNG (saves ~38 KB flash)" OFF)
option(AVM_PRINT_PROCESS_CRASH_DUMPS "Print crash reports when processes die with non-standard reasons" ON)

set(AVM_HSE_VALUE "" CACHE STRING "HSE crystal frequency in Hz (e.g. 25000000). Overrides family default.")
Expand Down
12 changes: 12 additions & 0 deletions src/platforms/stm32/cmake/stm32_device.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,10 +155,22 @@ else()
set(STM32_HAS_RNG FALSE)
endif()

# Flash-constrained devices that do have an RNG (e.g. stm32g474ret6, 384 KB
# flash) can opt out of mbedTLS/crypto to save ~38 KB. STM32_HAS_RNG is the
# sole gate for crypto (mbedTLS fetch/link + otp_crypto.c), so forcing it FALSE
# takes the same no-crypto path already exercised by RNG-less devices (g0b1).
if (STM32_HAS_RNG AND AVM_DISABLE_MBEDTLS)
set(STM32_HAS_RNG FALSE)
set(STM32_CRYPTO_DISABLED_BY_OPTION TRUE)
endif()

message("-----------Device Info-----------")
message(STATUS "Device : ${DEVICE}")
message(STATUS "Family : ${STM32_FAMILY}")
message(STATUS "CPU : ${STM32_CPU}")
message(STATUS "FPU : ${STM32_FPU}")
message(STATUS "Arch Flags : ${_arch_flags_str}")
message(STATUS "Has RNG : ${STM32_HAS_RNG}")
if (STM32_CRYPTO_DISABLED_BY_OPTION)
message(STATUS "Crypto : disabled via AVM_DISABLE_MBEDTLS (RNG present)")
endif()
Loading