Add mbedtls to bazel

Use it in kitchen_sink

MODULE.bazel

@@ -118,6 +118,13 @@ new_git_repository(
     remote = "https://github.com/lwip-tcpip/lwip.git",
 )
 
+new_git_repository(
+    name = "mbedtls",
+    build_file = "//src/rp2_common/pico_mbedtls:mbedtls.BUILD",
+    commit = "107ea89daaefb9867ea9121002fbbdf926780e98",  # keep-in-sync-with-submodule: lib/mbedtls
+    remote = "https://github.com/Mbed-TLS/mbedtls.git",
+)
+
 register_toolchains(
     "//bazel/toolchain:linux-aarch64-rp2040",
     "//bazel/toolchain:linux-aarch64-rp2350",

bazel/config/BUILD.bazel

@@ -294,3 +294,9 @@ label_flag(
     name = "PICO_FREERTOS_LIB",
     build_setting_default = "//bazel:empty_cc_lib",
 )
+
+# PICO_BAZEL_CONFIG: PICO_MBEDTL_CONFIG, [Bazel only] The cc_library that provides mbedtls_config.h, default=//bazel:empty_cc_lib, group=pico_mbedtls
+label_flag(
+    name = "PICO_MBEDTLS_CONFIG",
+    build_setting_default = "//bazel:empty_cc_lib",
+)

bazel/constraint/BUILD.bazel

@@ -252,3 +252,9 @@ label_flag_matches(
     flag = "//bazel/config:PICO_FREERTOS_LIB",
     value = "//bazel:empty_cc_lib",
 )
+
+label_flag_matches(
+    name = "pico_mbedtls_config_unset",
+    flag = "//bazel/config:PICO_MBEDTLS_CONFIG",
+    value = "//bazel:empty_cc_lib",
+)

bazel/util/transition.bzl

@@ -114,6 +114,7 @@ kitchen_sink_test_binary = declare_transtion(
     attrs = {
         "bt_stack_config": attr.label(mandatory = True),
         "lwip_config": attr.label(mandatory = True),
+        "mbedtls_config": attr.label(mandatory = True),
         "enable_ble": attr.bool(default = False),
         "enable_bt_classic": attr.bool(default = False),
         # This could be shared, but we don't in order to make it clearer that
@@ -127,6 +128,7 @@ kitchen_sink_test_binary = declare_transtion(
         "@pico-sdk//bazel/config:PICO_LWIP_CONFIG": "lwip_config",
         "@pico-sdk//bazel/config:PICO_BT_ENABLE_BLE": "enable_ble",
         "@pico-sdk//bazel/config:PICO_BT_ENABLE_CLASSIC": "enable_bt_classic",
+        "@pico-sdk//bazel/config:PICO_MBEDTLS_CONFIG": "mbedtls_config",
     },
 )
 

src/rp2_common/pico_lwip/lwip.BUILD

@@ -25,7 +25,15 @@ cc_library(
     deps = [
         ":pico_lwip_headers",
         "@pico-sdk//bazel/config:PICO_LWIP_CONFIG",
-    ],
+    ]
+    # altcp_alloc.c *might* depend on mbedtls
+    + select({
+        "@pico-sdk//bazel/constraint:pico_mbedtls_config_unset": [],
+        "//conditions:default": [
+            "@pico-sdk//src/rp2_common/pico_mbedtls:pico_mbedtls_library",
+        ]
+    })
+    ,
     target_compatible_with = incompatible_with_config("@pico-sdk//bazel/constraint:pico_lwip_config_unset")
 )
 
@@ -142,7 +150,11 @@ cc_library(
         "src/apps/altcp_tls/altcp_tls_mbedtls_mem.c",
         "src/apps/snmp/snmpv3_mbedtls.c",
     ],
-    deps = [":pico_lwip_core"],
+    includes = ["src/apps/altcp_tls"],
+    deps = [
+        ":pico_lwip_core",
+        "@pico-sdk//src/rp2_common/pico_mbedtls:pico_mbedtls_config"
+    ],
 )
 
 cc_library(

src/rp2_common/pico_mbedtls/BUILD.bazel

@@ -2,6 +2,13 @@ load("//bazel:defs.bzl", "compatible_with_rp2")
 
 package(default_visibility = ["//visibility:public"])
 
+cc_library(
+    name = "pico_mbedtls_config",
+    includes = ["include"],
+    hdrs = ["include/pico_mbedtls_config.h"],
+    defines = ['MBEDTLS_CONFIG_FILE=\\"pico_mbedtls_config.h\\"'],
+)
+
 cc_library(
     name = "pico_mbedtls",
     srcs = ["pico_mbedtls.c"],
@@ -9,9 +16,17 @@ cc_library(
     includes = ["include"],
     target_compatible_with = compatible_with_rp2(),
     deps = [
-        "//bazel/config:PICO_MBEDTLS_LIB",
+        ":pico_mbedtls_library",
+        ":pico_mbedtls_config",
         "//src/rp2_common:pico_platform",
         "//src/rp2_common/pico_rand",
-        "//src/rp2_common/pico_sha256",
-    ],
+    ] + select({
+        "//bazel/constraint:rp2350": [ "//src/rp2_common/pico_sha256" ],
+        "//conditions:default": [ ],
+    }),
+)
+
+alias(
+    name = "pico_mbedtls_library",
+    actual = "@mbedtls//:pico_mbedtls_library",
 )

src/rp2_common/pico_mbedtls/mbedtls.BUILD

@@ -0,0 +1,23 @@
+load("@pico-sdk//bazel:defs.bzl", "incompatible_with_config")
+
+package(default_visibility = ["//visibility:public"])
+
+cc_library(
+    name = "pico_mbedtls_library",
+    srcs = glob(
+    	["library/*.c"],
+    	exclude = ["*mbedtls.c"],
+    ),
+    hdrs = glob(
+        include = [
+            "include/**/*.h",
+            "library/*.h",
+        ],
+    ),
+    includes = ["include"],
+    target_compatible_with = incompatible_with_config("@pico-sdk//bazel/constraint:pico_mbedtls_config_unset"),
+    deps = [
+        "@pico-sdk//src/rp2_common/pico_mbedtls:pico_mbedtls_config",
+        "@pico-sdk//bazel/config:PICO_MBEDTLS_CONFIG",
+    ],
+)

test/kitchen_sink/BUILD.bazel

@@ -110,6 +110,8 @@ cc_binary(
         ":kitchen_sink_common",
         "//src/rp2_common/pico_cyw43_arch:pico_cyw43_arch_lwip_poll",
         "//src/rp2_common/pico_btstack:pico_btstack",
+        "//src/rp2_common/pico_lwip:pico_lwip_mbedtls",
+        "//src/rp2_common/pico_mbedtls",
     ],
 )
 
@@ -121,6 +123,9 @@ cc_binary(
     deps = [
         ":kitchen_sink_common",
         "//src/rp2_common/pico_cyw43_arch:pico_cyw43_arch_lwip_threadsafe_background",
+        "//src/rp2_common/pico_btstack:pico_btstack",
+        "//src/rp2_common/pico_lwip:pico_lwip_mbedtls",
+        "//src/rp2_common/pico_mbedtls",
     ],
 )
 
@@ -130,6 +135,7 @@ kitchen_sink_test_binary(
     src = ":kitchen_sink_lwip_poll_actual",
     bt_stack_config = ":btstack_config",
     lwip_config = ":lwip_config",
+    mbedtls_config = ":mbedtls_config",
     enable_ble = True,
     enable_bt_classic = True,
     target_compatible_with = compatible_with_rp2(),
@@ -141,6 +147,7 @@ kitchen_sink_test_binary(
     src = ":kitchen_sink_lwip_background_actual",
     bt_stack_config = ":btstack_config",
     lwip_config = ":lwip_config",
+    mbedtls_config = ":mbedtls_config",
     enable_ble = True,
     enable_bt_classic = True,
     target_compatible_with = compatible_with_rp2(),

tools/compare_build_systems.py

@@ -135,6 +135,7 @@ BAZEL_ONLY_ALLOWLIST = (
     # Bazel configuration for 3p deps.
     "PICO_BTSTACK_CONFIG",
     "PICO_LWIP_CONFIG",
+    "PICO_MBEDTLS_CONFIG",
     "PICO_FREERTOS_LIB",
     "PICO_MBEDTLS_LIB",
     # CMake has PICO_DEFAULT_CLIB, but it's not user-facing.