Merge remote-tracking branch 'main' into restricted-framework-merge-public-20250916

tests/include/test/bignum_helpers.h

@@ -17,7 +17,11 @@
 
 #if defined(MBEDTLS_BIGNUM_C)
 
+#if !defined(MBEDTLS_VERSION_MAJOR) || MBEDTLS_VERSION_MAJOR >= 4
+#include <mbedtls/private/bignum.h>
+#else
 #include <mbedtls/bignum.h>
+#endif
 #include <bignum_mod.h>
 
 /** Allocate and populate a core MPI from a test case argument.

tests/include/test/drivers/cipher.h

@@ -16,7 +16,11 @@
 #include <psa/crypto_driver_common.h>
 #include <psa/crypto.h>
 
+#if !defined(MBEDTLS_VERSION_MAJOR) || MBEDTLS_VERSION_MAJOR >= 4
+#include "mbedtls/private/cipher.h"
+#else
 #include "mbedtls/cipher.h"
+#endif
 
 typedef struct {
     /* If non-null, on success, copy this to the output. */

tests/include/test/fake_external_rng_for_test.h

@@ -37,7 +37,7 @@ void mbedtls_test_enable_insecure_external_rng(void);
 void mbedtls_test_disable_insecure_external_rng(void);
 #endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
 
-#if defined(MBEDTLS_PLATFORM_GET_ENTROPY_ALT) || defined(MBEDTLS_PSA_DRIVER_GET_ENTROPY)
+#if defined(MBEDTLS_PSA_DRIVER_GET_ENTROPY)
 
 #include <mbedtls/platform.h>
 
@@ -73,6 +73,6 @@ void mbedtls_test_platform_get_entropy_set_entropy_content(size_t val);
 /* Return the number of times mbedtls_platform_get_entropy() was called. */
 size_t mbedtls_test_platform_get_entropy_get_call_count(void);
 
-#endif /* MBEDTLS_PLATFORM_GET_ENTROPY_ALT || MBEDTLS_PSA_DRIVER_GET_ENTROPY */
+#endif /* MBEDTLS_PSA_DRIVER_GET_ENTROPY */
 
 #endif /* FAKE_EXTERNAL_RNG_FOR_TEST_H */

tests/include/test/helpers.h

@@ -51,9 +51,15 @@
 #include <stdint.h>
 
 #if defined(MBEDTLS_BIGNUM_C)
+
+#if !defined(MBEDTLS_VERSION_MAJOR) || MBEDTLS_VERSION_MAJOR >= 4
+#include "mbedtls/private/bignum.h"
+#else
 #include "mbedtls/bignum.h"
 #endif
 
+#endif
+
 /** The type of test case arguments that contain binary data. */
 typedef struct data_tag {
     uint8_t *x;

tests/include/test/macros.h

@@ -21,7 +21,12 @@
 #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
 #include "mbedtls/memory_buffer_alloc.h"
 #endif
+
+#if defined(TF_PSA_CRYPTO_VERSION_NUMBER)
+#include "tf_psa_crypto_common.h"
+#else
 #include "common.h"
+#endif
 
 /**
  * \brief   This macro tests the expression passed to it as a test step or

tests/include/test/psa_crypto_helpers.h

@@ -17,7 +17,12 @@
 #endif
 
 #include <psa/crypto.h>
+
+#if !defined(MBEDTLS_VERSION_MAJOR) || MBEDTLS_VERSION_MAJOR >= 4
+#include <mbedtls/private/ctr_drbg.h>
+#else
 #include <mbedtls/ctr_drbg.h>
+#endif
 
 #if defined(MBEDTLS_PSA_CRYPTO_C)
 /** Initialize the PSA Crypto subsystem. */

tests/include/test/threading_helpers.h

@@ -13,18 +13,31 @@
 #ifndef THREADING_HELPERS_H
 #define THREADING_HELPERS_H
 
-#if defined MBEDTLS_THREADING_C
-
 #include "mbedtls/private_access.h"
 #include "mbedtls/build_info.h"
 
+#if defined MBEDTLS_THREADING_C
+
+#include <mbedtls/threading.h>
+
 /* Most fields of publicly available structs are private and are wrapped with
  * MBEDTLS_PRIVATE macro. This define allows tests to access the private fields
  * directly (without using the MBEDTLS_PRIVATE wrapper). */
 #define MBEDTLS_ALLOW_PRIVATE_ACCESS
 
+/* Error in thread management */
 #define MBEDTLS_ERR_THREADING_THREAD_ERROR                 -0x001F
 
+/* Error in mutex usage (used in Mbed TLS up to 3.6, no longer used
+ * outside the test framework since TF-PSA-Crypto 1.0).
+ *
+ * In Mbed TLS 3.5, this is a redefinition of the macro to the same
+ * value (down to the exact sequence of tokens and presence/absence of
+ * whitespace between tokens), which is valid C.
+ */
+#define MBEDTLS_ERR_THREADING_BAD_INPUT_DATA              -0x001C
+
+
 #if defined(MBEDTLS_THREADING_PTHREAD)
 #include <pthread.h>
 #endif /* MBEDTLS_THREADING_PTHREAD */

tests/programs/metatest.c

@@ -34,13 +34,12 @@
 #include "test/threading_helpers.h"
 #include "test/macros.h"
 #include "test/memory.h"
-#include "common.h"
 
 #include <stdio.h>
 #include <string.h>
 
 #if defined(MBEDTLS_THREADING_C)
-#include <mbedtls/threading.h>
+#include "threading_internal.h"
 #endif
 
 
@@ -286,6 +285,10 @@ exit:
 #endif
 }
 
+/* Since TF-PSA-Crypto 1.0, mbedtls_mutex_free() on an all-bits-zero
+ * mutex is defined to be a no-op. In earlier library versions,
+ * it had undefined behavior. */
+#if MBEDTLS_THREADING_INTERNAL_VERSION <= 0x04000000
 static void mutex_free_not_initialized(const char *name)
 {
     (void) name;
@@ -299,6 +302,7 @@ static void mutex_free_not_initialized(const char *name)
     mbedtls_mutex_free(&mutex);
 #endif
 }
+#endif
 
 static void mutex_double_init(const char *name)
 {
@@ -315,6 +319,10 @@ static void mutex_double_init(const char *name)
 #endif
 }
 
+/* Since TF-PSA-Crypto 1.0, mbedtls_mutex_free() on an all-bits-zero
+ * mutex is defined to be a no-op. In earlier library versions,
+ * it had undefined behavior. */
+#if MBEDTLS_THREADING_INTERNAL_VERSION <= 0x04000000
 static void mutex_double_free(const char *name)
 {
     (void) name;
@@ -329,6 +337,7 @@ static void mutex_double_free(const char *name)
     mbedtls_mutex_free(&mutex);
 #endif
 }
+#endif
 
 static void mutex_leak(const char *name)
 {
@@ -418,9 +427,13 @@ metatest_t metatests[] = {
     { "test_memory_poison_7_1_2_w", "poison", test_memory_poison },
     { "mutex_lock_not_initialized", "pthread", mutex_lock_not_initialized },
     { "mutex_unlock_not_initialized", "pthread", mutex_unlock_not_initialized },
+#if MBEDTLS_THREADING_INTERNAL_VERSION <= 0x04000000
     { "mutex_free_not_initialized", "pthread", mutex_free_not_initialized },
+#endif
     { "mutex_double_init", "pthread", mutex_double_init },
+#if MBEDTLS_THREADING_INTERNAL_VERSION <= 0x04000000
     { "mutex_double_free", "pthread", mutex_double_free },
+#endif
     { "mutex_leak", "pthread", mutex_leak },
     { NULL, NULL, NULL }
 };

tests/src/bignum_helpers.c

@@ -18,7 +18,12 @@
 #include <stdlib.h>
 #include <string.h>
 
+#if !defined(MBEDTLS_VERSION_MAJOR) || MBEDTLS_VERSION_MAJOR >= 4
+#include <mbedtls/private/bignum.h>
+#else
 #include <mbedtls/bignum.h>
+#endif
+
 #include <bignum_core.h>
 #include <bignum_mod.h>
 #include <bignum_mod_raw.h>

tests/src/drivers/test_driver_asymmetric_encryption.c

@@ -9,7 +9,13 @@
 
 #if defined(PSA_CRYPTO_DRIVER_TEST)
 #include "psa/crypto.h"
+
+#if !defined(MBEDTLS_VERSION_MAJOR) || MBEDTLS_VERSION_MAJOR >= 4
+#include "mbedtls/private/rsa.h"
+#else
 #include "mbedtls/rsa.h"
+#endif
+
 #include "psa_crypto_rsa.h"
 #include "string.h"
 #include "test/drivers/asymmetric_encryption.h"

tests/src/drivers/test_driver_cipher.c

@@ -12,7 +12,12 @@
 #include "psa/crypto.h"
 #include "psa_crypto_cipher.h"
 #include "psa_crypto_core.h"
+
+#if !defined(MBEDTLS_VERSION_MAJOR) || MBEDTLS_VERSION_MAJOR >= 4
+#include "mbedtls/private/cipher.h"
+#else
 #include "mbedtls/cipher.h"
+#endif
 
 #include "test/drivers/cipher.h"
 

tests/src/drivers/test_driver_key_management.c

@@ -14,7 +14,13 @@
 #include "psa_crypto_ecp.h"
 #include "psa_crypto_rsa.h"
 #include "psa_crypto_ffdh.h"
+
+#if !defined(MBEDTLS_VERSION_MAJOR) || MBEDTLS_VERSION_MAJOR >= 4
+#include "mbedtls/private/ecp.h"
+#else
 #include "mbedtls/ecp.h"
+#endif
+
 #include "mbedtls/error.h"
 
 #include "test/drivers/key_management.h"

tests/src/drivers/test_driver_signature.c

@@ -15,13 +15,22 @@
 #include "psa_crypto_ecp.h"
 #include "psa_crypto_hash.h"
 #include "psa_crypto_rsa.h"
+
+#if !defined(MBEDTLS_VERSION_MAJOR) || MBEDTLS_VERSION_MAJOR >= 4
+#include "mbedtls/private/ecp.h"
+#else
 #include "mbedtls/ecp.h"
+#endif
 
 #include "test/drivers/hash.h"
 #include "test/drivers/signature.h"
 #include "test/drivers/hash.h"
 
+#if !defined(MBEDTLS_VERSION_MAJOR) || MBEDTLS_VERSION_MAJOR >= 4
+#include "mbedtls/private/ecdsa.h"
+#else
 #include "mbedtls/ecdsa.h"
+#endif
 
 #include "test/random.h"
 

tests/src/fake_external_rng_for_test.c

@@ -55,10 +55,15 @@ psa_status_t mbedtls_psa_external_get_random(
 
 #endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
 
-#if defined(MBEDTLS_PLATFORM_GET_ENTROPY_ALT) || defined(MBEDTLS_PSA_DRIVER_GET_ENTROPY)
+#if defined(MBEDTLS_PSA_DRIVER_GET_ENTROPY)
 
 #include <test/random.h>
+
+#if !defined(MBEDTLS_VERSION_MAJOR) || MBEDTLS_VERSION_MAJOR >= 4
+#include <mbedtls/private/entropy.h>
+#else
 #include <mbedtls/entropy.h>
+#endif
 
 static int platform_get_entropy_force_failure;
 static size_t platform_get_entropy_forced_entropy_content = SIZE_MAX;
@@ -125,7 +130,7 @@ static int fake_get_entropy(unsigned char *output, size_t output_size,
     return 0;
 }
 
-#endif /* MBEDTLS_PLATFORM_GET_ENTROPY_ALT || MBEDTLS_PSA_DRIVER_GET_ENTROPY */
+#endif /* MBEDTLS_PSA_DRIVER_GET_ENTROPY */
 
 #if defined(MBEDTLS_PSA_DRIVER_GET_ENTROPY)
 int mbedtls_platform_get_entropy(psa_driver_get_entropy_flags_t flags,
@@ -140,18 +145,4 @@ int mbedtls_platform_get_entropy(psa_driver_get_entropy_flags_t flags,
     int ret = fake_get_entropy(output, output_size, estimate_bits);
     return ret;
 }
-#elif defined(MBEDTLS_PLATFORM_GET_ENTROPY_ALT)
-int mbedtls_platform_get_entropy(unsigned char *output, size_t output_size,
-                                 size_t *output_len, size_t *entropy_content)
-{
-    int ret = fake_get_entropy(output, output_size, entropy_content);
-    if (ret == 0) {
-        if (platform_get_entropy_forced_output_len == SIZE_MAX) {
-            *output_len = output_size;
-        } else {
-            *output_len = platform_get_entropy_forced_output_len;
-        }
-    }
-    return ret;
-}
-#endif /* MBEDTLS_PLATFORM_GET_ENTROPY_ALT */
+#endif /* MBEDTLS_PSA_DRIVER_GET_ENTROPY */

tests/src/psa_crypto_helpers.c

@@ -14,8 +14,12 @@
 #include <test/psa_crypto_helpers.h>
 
 #if defined(MBEDTLS_CTR_DRBG_C)
+#if !defined(MBEDTLS_VERSION_MAJOR) || MBEDTLS_VERSION_MAJOR >= 4
+#include <mbedtls/private/ctr_drbg.h>
+#else
 #include <mbedtls/ctr_drbg.h>
 #endif
+#endif
 
 #if defined(MBEDTLS_PSA_CRYPTO_C)
 
@@ -249,7 +253,12 @@ exit:
 
 #if defined(MBEDTLS_PSA_INJECT_ENTROPY)
 
+#if !defined(MBEDTLS_VERSION_MAJOR) || MBEDTLS_VERSION_MAJOR >= 4
+#include <mbedtls/private/entropy.h>
+#else
 #include <mbedtls/entropy.h>
+#endif
+
 #include <psa_crypto_its.h>
 
 int mbedtls_test_inject_entropy_seed_read(unsigned char *buf, size_t len)

tests/src/psa_exercise_key.c

@@ -25,7 +25,13 @@
 #include <pk_internal.h>
 #endif
 #if defined(MBEDTLS_ECP_C)
+
+#if !defined(MBEDTLS_VERSION_MAJOR) || MBEDTLS_VERSION_MAJOR >= 4
+#include <mbedtls/private/ecp.h>
+#else
 #include <mbedtls/ecp.h>
+#endif
+
 #endif
 #if defined(MBEDTLS_RSA_C)
 #include <rsa_internal.h>

tests/src/random.c

@@ -23,7 +23,11 @@
 #include <test/random.h>
 #include <string.h>
 
+#if !defined(MBEDTLS_VERSION_MAJOR) || MBEDTLS_VERSION_MAJOR >= 4
+#include <mbedtls/private/entropy.h>
+#else
 #include <mbedtls/entropy.h>
+#endif
 #include <alignment.h>
 
 int mbedtls_test_rnd_std_rand(void *rng_state,

tests/src/threading_helpers.c

@@ -9,7 +9,7 @@
 #include <test/threading_helpers.h>
 #include <test/macros.h>
 
-#include "mbedtls/threading.h"
+#include "threading_internal.h"
 
 #if defined(MBEDTLS_THREADING_C)
 
@@ -135,11 +135,54 @@ enum value_of_mutex_state_field {
     MUTEX_LOCKED = 2, //! < Set by mbedtls_test_wrap_mutex_lock
 };
 
+#if MBEDTLS_THREADING_INTERNAL_VERSION < 0x04000000
+/* Historically, the mutex functions in the API were function pointers.
+ * Since TF-PSA-Crypto 1.0.0 (paired with Mbed TLS 4.0.0), the API
+ * functions have the historical names but the pointers have different
+ * names. When building against Mbed TLS 3.6.x, define the pointer name
+ * as aliases. */
+#define mbedtls_mutex_init_ptr mbedtls_mutex_init
+#define mbedtls_mutex_free_ptr mbedtls_mutex_free
+#define mbedtls_mutex_lock_ptr mbedtls_mutex_lock
+#define mbedtls_mutex_unlock_ptr mbedtls_mutex_unlock
+
+typedef mbedtls_threading_mutex_t mbedtls_platform_mutex_t;
+#define mutex_container(platform_mutex) (platform_mutex)
+
+#else /* MBEDTLS_THREADING_INTERNAL_VERSION >= 0x04000000 */
+
+/* Historically, the mutex platform functions received a pointer to the
+ * mbedtls_threading_mutex_t object, and the pthread implementation of
+ * that type had a state field. Now the platform functions receive a pointer
+ * to the mbedtls_platform_mutex_t object which is a field of the
+ * mbedtls_threading_mutex_t object. Get a pointer to the containing
+ * object which holds the state field.
+ *
+ * This weird arrangement was done to minimize changes when switching the
+ * mutex usage framework to the separated platform/API types. In the future
+ * we should clean up how the usage framework fits into the library.
+ */
+static mbedtls_threading_mutex_t *mutex_container(
+    mbedtls_platform_mutex_t *platform_mutex)
+{
+    unsigned char *field_address = (unsigned char *) platform_mutex;
+    size_t offset = offsetof(mbedtls_threading_mutex_t, mutex);
+    return (mbedtls_threading_mutex_t *) (field_address - offset);
+}
+
+#endif /* MBEDTLS_THREADING_INTERNAL_VERSION */
+
+#if MBEDTLS_THREADING_INTERNAL_VERSION >= 0x04000001
+typedef int mutex_init_return_t;
+#else
+typedef void mutex_init_return_t;
+#endif
+
 typedef struct {
-    void (*init)(mbedtls_threading_mutex_t *);
-    void (*free)(mbedtls_threading_mutex_t *);
-    int (*lock)(mbedtls_threading_mutex_t *);
-    int (*unlock)(mbedtls_threading_mutex_t *);
+    mutex_init_return_t (*init)(mbedtls_platform_mutex_t *);
+    void (*free)(mbedtls_platform_mutex_t *);
+    int (*lock)(mbedtls_platform_mutex_t *);
+    int (*unlock)(mbedtls_platform_mutex_t *);
 } mutex_functions_t;
 static mutex_functions_t mutex_functions;
 
@@ -159,7 +202,7 @@ static mutex_functions_t mutex_functions;
  *  testing. This is not a situation that is likely to happen with normal
  *  testing and we still have TSan to fall back on should this happen.
  */
-mbedtls_threading_mutex_t mbedtls_test_mutex_mutex;
+mbedtls_platform_mutex_t mbedtls_test_mutex_mutex;
 
 /**
  *  The total number of calls to mbedtls_mutex_init(), minus the total number
@@ -170,7 +213,7 @@ mbedtls_threading_mutex_t mbedtls_test_mutex_mutex;
  */
 static int live_mutexes;
 
-static void mbedtls_test_mutex_usage_error(mbedtls_threading_mutex_t *mutex,
+static void mbedtls_test_mutex_usage_error(mbedtls_platform_mutex_t *mutex,
                                            const char *msg)
 {
     (void) mutex;
@@ -183,7 +226,7 @@ static void mbedtls_test_mutex_usage_error(mbedtls_threading_mutex_t *mutex,
      * mbedtls_test_mutex_usage_check() will mark it as failed. */
 }
 
-static int mbedtls_test_mutex_can_test(mbedtls_threading_mutex_t *mutex)
+static int mbedtls_test_mutex_can_test(mbedtls_platform_mutex_t *mutex)
 {
     /* If we attempt to run tests on this mutex then we are going to run into a
      * couple of problems:
@@ -191,38 +234,49 @@ static int mbedtls_test_mutex_can_test(mbedtls_threading_mutex_t *mutex)
      * reporting that failure, as we already hold the mutex at that point.
      * 2. Given the 'global' position of the initialization and free of this
      * mutex, it will be shown as leaked on the first test run. */
-    if (mutex == mbedtls_test_get_info_mutex()) {
+    if (mutex_container(mutex) == mbedtls_test_get_info_mutex()) {
         return 0;
     }
 
     return 1;
 }
 
-static void mbedtls_test_wrap_mutex_init(mbedtls_threading_mutex_t *mutex)
+static mutex_init_return_t mbedtls_test_wrap_mutex_init(mbedtls_platform_mutex_t *mutex)
 {
+#if MBEDTLS_THREADING_INTERNAL_VERSION >= 0x04000001
+    int ret = mutex_functions.init(mutex);
+    if (ret != 0) {
+        return ret;
+    }
+#else
     mutex_functions.init(mutex);
+#endif
 
     if (mbedtls_test_mutex_can_test(mutex)) {
         if (mutex_functions.lock(&mbedtls_test_mutex_mutex) == 0) {
-            mutex->state = MUTEX_IDLE;
+            mutex_container(mutex)->state = MUTEX_IDLE;
             ++live_mutexes;
 
             mutex_functions.unlock(&mbedtls_test_mutex_mutex);
         }
     }
+
+#if MBEDTLS_THREADING_INTERNAL_VERSION >= 0x04000001
+    return 0;
+#endif
 }
 
-static void mbedtls_test_wrap_mutex_free(mbedtls_threading_mutex_t *mutex)
+static void mbedtls_test_wrap_mutex_free(mbedtls_platform_mutex_t *mutex)
 {
     if (mbedtls_test_mutex_can_test(mutex)) {
         if (mutex_functions.lock(&mbedtls_test_mutex_mutex) == 0) {
 
-            switch (mutex->state) {
+            switch (mutex_container(mutex)->state) {
                 case MUTEX_FREED:
                     mbedtls_test_mutex_usage_error(mutex, "free without init or double free");
                     break;
                 case MUTEX_IDLE:
-                    mutex->state = MUTEX_FREED;
+                    mutex_container(mutex)->state = MUTEX_FREED;
                     --live_mutexes;
                     break;
                 case MUTEX_LOCKED:
@@ -240,7 +294,7 @@ static void mbedtls_test_wrap_mutex_free(mbedtls_threading_mutex_t *mutex)
     mutex_functions.free(mutex);
 }
 
-static int mbedtls_test_wrap_mutex_lock(mbedtls_threading_mutex_t *mutex)
+static int mbedtls_test_wrap_mutex_lock(mbedtls_platform_mutex_t *mutex)
 {
     /* Lock the passed in mutex first, so that the only way to change the state
      * is to hold the passed in and internal mutex - otherwise we create a race
@@ -249,13 +303,13 @@ static int mbedtls_test_wrap_mutex_lock(mbedtls_threading_mutex_t *mutex)
 
     if (mbedtls_test_mutex_can_test(mutex)) {
         if (mutex_functions.lock(&mbedtls_test_mutex_mutex) == 0) {
-            switch (mutex->state) {
+            switch (mutex_container(mutex)->state) {
                 case MUTEX_FREED:
                     mbedtls_test_mutex_usage_error(mutex, "lock without init");
                     break;
                 case MUTEX_IDLE:
                     if (ret == 0) {
-                        mutex->state = MUTEX_LOCKED;
+                        mutex_container(mutex)->state = MUTEX_LOCKED;
                     }
                     break;
                 case MUTEX_LOCKED:
@@ -273,14 +327,14 @@ static int mbedtls_test_wrap_mutex_lock(mbedtls_threading_mutex_t *mutex)
     return ret;
 }
 
-static int mbedtls_test_wrap_mutex_unlock(mbedtls_threading_mutex_t *mutex)
+static int mbedtls_test_wrap_mutex_unlock(mbedtls_platform_mutex_t *mutex)
 {
     /* Lock the internal mutex first and change state, so that the only way to
      * change the state is to hold the passed in and internal mutex - otherwise
      * we create a race condition. */
     if (mbedtls_test_mutex_can_test(mutex)) {
         if (mutex_functions.lock(&mbedtls_test_mutex_mutex) == 0) {
-            switch (mutex->state) {
+            switch (mutex_container(mutex)->state) {
                 case MUTEX_FREED:
                     mbedtls_test_mutex_usage_error(mutex, "unlock without init");
                     break;
@@ -288,7 +342,7 @@ static int mbedtls_test_wrap_mutex_unlock(mbedtls_threading_mutex_t *mutex)
                     mbedtls_test_mutex_usage_error(mutex, "unlock without lock");
                     break;
                 case MUTEX_LOCKED:
-                    mutex->state = MUTEX_IDLE;
+                    mutex_container(mutex)->state = MUTEX_IDLE;
                     break;
                 default:
                     mbedtls_test_mutex_usage_error(mutex, "corrupted state");
@@ -303,14 +357,14 @@ static int mbedtls_test_wrap_mutex_unlock(mbedtls_threading_mutex_t *mutex)
 
 void mbedtls_test_mutex_usage_init(void)
 {
-    mutex_functions.init = mbedtls_mutex_init;
-    mutex_functions.free = mbedtls_mutex_free;
-    mutex_functions.lock = mbedtls_mutex_lock;
-    mutex_functions.unlock = mbedtls_mutex_unlock;
-    mbedtls_mutex_init = &mbedtls_test_wrap_mutex_init;
-    mbedtls_mutex_free = &mbedtls_test_wrap_mutex_free;
-    mbedtls_mutex_lock = &mbedtls_test_wrap_mutex_lock;
-    mbedtls_mutex_unlock = &mbedtls_test_wrap_mutex_unlock;
+    mutex_functions.init = *mbedtls_mutex_init_ptr;
+    mutex_functions.free = *mbedtls_mutex_free_ptr;
+    mutex_functions.lock = *mbedtls_mutex_lock_ptr;
+    mutex_functions.unlock = *mbedtls_mutex_unlock_ptr;
+    mbedtls_mutex_init_ptr = &mbedtls_test_wrap_mutex_init;
+    mbedtls_mutex_free_ptr = &mbedtls_test_wrap_mutex_free;
+    mbedtls_mutex_lock_ptr = &mbedtls_test_wrap_mutex_lock;
+    mbedtls_mutex_unlock_ptr = &mbedtls_test_wrap_mutex_unlock;
 
     mutex_functions.init(&mbedtls_test_mutex_mutex);
 }
@@ -341,10 +395,10 @@ void mbedtls_test_mutex_usage_check(void)
 
 void mbedtls_test_mutex_usage_end(void)
 {
-    mbedtls_mutex_init = mutex_functions.init;
-    mbedtls_mutex_free = mutex_functions.free;
-    mbedtls_mutex_lock = mutex_functions.lock;
-    mbedtls_mutex_unlock = mutex_functions.unlock;
+    mbedtls_mutex_init_ptr = mutex_functions.init;
+    mbedtls_mutex_free_ptr = mutex_functions.free;
+    mbedtls_mutex_lock_ptr = mutex_functions.lock;
+    mbedtls_mutex_unlock_ptr = mutex_functions.unlock;
 
     mutex_functions.free(&mbedtls_test_mutex_mutex);
 }