From 160096a0a38a8f1ef9e6dc8e648fd690fff445f1 Mon Sep 17 00:00:00 2001
From: Yi Wu <yi.wu2@arm.com>
Date: Thu, 6 Aug 2026 09:46:32 +0100
Subject: [PATCH] Cmake: add support for config options

Signed-off-by: Yi Wu <yi.wu2@arm.com>
---
 CMakeLists.txt               | 65 ++++++++++++++++++++++++++++++++++++
 ChangeLog.d/cmake-config.txt |  4 +++
 2 files changed, 69 insertions(+)
 create mode 100644 ChangeLog.d/cmake-config.txt

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 527b443050..bc13e8c4a2 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -134,6 +134,71 @@ endif()
 # Make MBEDTLS_CONFIG_FILE and MBEDTLS_USER_CONFIG_FILE into PATHs
 set(MBEDTLS_CONFIG_FILE "" CACHE FILEPATH "Mbed TLS config file (overrides default).")
 set(MBEDTLS_USER_CONFIG_FILE "" CACHE FILEPATH "Mbed TLS user config file (appended to default).")
+set(MBEDTLS_CONFIG_NAME "" CACHE STRING "Named Mbed TLS configuration (see config.py).")
+set(MBEDTLS_CONFIG_SET "" CACHE STRING "Options to set, separated by semicolons (OPTION or OPTION=VALUE).")
+set(MBEDTLS_CONFIG_UNSET "" CACHE STRING "Options to unset, separated by semicolons.")
+
+if(MBEDTLS_CONFIG_NAME OR MBEDTLS_CONFIG_SET OR MBEDTLS_CONFIG_UNSET)
+    if(MBEDTLS_CONFIG_FILE)
+        message(FATAL_ERROR
+            "MBEDTLS_CONFIG_FILE cannot be combined with MBEDTLS_CONFIG_NAME, "
+            "MBEDTLS_CONFIG_SET or MBEDTLS_CONFIG_UNSET.")
+    endif()
+    if(NOT MBEDTLS_PYTHON_EXECUTABLE)
+        message(FATAL_ERROR "Python 3 is required to generate an Mbed TLS configuration file.")
+    endif()
+
+    set(MBEDTLS_GENERATED_CONFIG_DIR "${CMAKE_CURRENT_BINARY_DIR}/generated/include")
+    set(MBEDTLS_GENERATED_CONFIG_FILE "${MBEDTLS_GENERATED_CONFIG_DIR}/mbedtls/mbedtls_config.h")
+    set(MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE "${MBEDTLS_GENERATED_CONFIG_DIR}/psa/crypto_config.h")
+    file(MAKE_DIRECTORY "${MBEDTLS_GENERATED_CONFIG_DIR}/mbedtls")
+    file(MAKE_DIRECTORY "${MBEDTLS_GENERATED_CONFIG_DIR}/psa")
+    file(COPY "${CMAKE_CURRENT_SOURCE_DIR}/include/mbedtls/mbedtls_config.h"
+         DESTINATION "${MBEDTLS_GENERATED_CONFIG_DIR}/mbedtls")
+    # config.py handles the Mbed TLS and PSA configurations together. Give it
+    # a build-tree PSA configuration so that it never modifies the source tree.
+    file(COPY "${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/include/psa/crypto_config.h"
+         DESTINATION "${MBEDTLS_GENERATED_CONFIG_DIR}/psa")
+
+    function(mbedtls_configure_generated_file)
+        execute_process(
+            COMMAND
+                ${MBEDTLS_PYTHON_EXECUTABLE}
+                "${CMAKE_CURRENT_SOURCE_DIR}/scripts/config.py"
+                --file "${MBEDTLS_GENERATED_CONFIG_FILE}"
+                --cryptofile "${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}"
+                ${ARGN}
+            RESULT_VARIABLE result
+        )
+        if(result)
+            message(FATAL_ERROR "Failed to configure the generated Mbed TLS configuration file")
+        endif()
+    endfunction(mbedtls_configure_generated_file)
+
+    if(MBEDTLS_CONFIG_NAME)
+        mbedtls_configure_generated_file("${MBEDTLS_CONFIG_NAME}")
+    endif()
+    foreach(option IN LISTS MBEDTLS_CONFIG_UNSET)
+        mbedtls_configure_generated_file(unset "${option}")
+    endforeach(option)
+    foreach(option IN LISTS MBEDTLS_CONFIG_SET)
+        string(FIND "${option}" "=" separator)
+        if(separator EQUAL -1)
+            mbedtls_configure_generated_file(--force set "${option}")
+        else()
+            string(SUBSTRING "${option}" 0 ${separator} name)
+            math(EXPR value_start "${separator} + 1")
+            string(SUBSTRING "${option}" ${value_start} -1 value)
+            mbedtls_configure_generated_file(--force set "${name}" "${value}")
+        endif()
+    endforeach(option)
+
+    set(MBEDTLS_CONFIG_FILE "${MBEDTLS_GENERATED_CONFIG_FILE}")
+    if(NOT TF_PSA_CRYPTO_CONFIG_FILE AND NOT TF_PSA_CRYPTO_CONFIG_NAME)
+        # Named configurations can adjust both configuration files.
+        set(TF_PSA_CRYPTO_CONFIG_FILE "${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}")
+    endif()
+endif()
 
 # Create a symbolic link from ${base_name} in the binary directory
 # to the corresponding path in the source directory.
diff --git a/ChangeLog.d/cmake-config.txt b/ChangeLog.d/cmake-config.txt
new file mode 100644
index 0000000000..adbf7c6084
--- /dev/null
+++ b/ChangeLog.d/cmake-config.txt
@@ -0,0 +1,4 @@
+Features
+   * Add the `MBEDTLS_CONFIG_NAME`, `MBEDTLS_CONFIG_SET` and
+     `MBEDTLS_CONFIG_UNSET` CMake options for selecting and customizing
+     compile-time configurations. Fixes #10838.