coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-09-13 14:22:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

CMake: combine Mbed TLS and PSA transformations

Browse Source 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
This commit is contained in:
Yi Wu 2026-08-20 17:03:11 +01:00
parent 5c906f7fa0
commit d18007682d
2 changed files with 68 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
CMakeLists.txt
View File

@ -134,7 +134,7 @@ endif()
# Make configuration file options into PATHs # Make configuration file options into PATHs
set(MBEDTLS_CONFIG_FILE "" CACHE FILEPATH "Mbed TLS config file (overrides default).") set(MBEDTLS_CONFIG_FILE "" CACHE FILEPATH "Mbed TLS config file (overrides default).")
set(MBEDTLS_USER_CONFIG_FILE "" CACHE FILEPATH "Mbed TLS user config file (appended to default).") set(MBEDTLS_USER_CONFIG_FILE "" CACHE FILEPATH "Mbed TLS user config file (appended to default).")
set(MBEDTLS_CONFIG_BASE_FILE "" CACHE FILEPATH "Mbed TLS config to copy and optionally transform.") set(MBEDTLS_CONFIG_BASE_FILE "" CACHE STRING "Mbed TLS config to copy and optionally transform.")
set(MBEDTLS_CONFIG_NAME "" CACHE STRING "Named Mbed TLS configuration (see config.py).") set(MBEDTLS_CONFIG_NAME "" CACHE STRING "Named Mbed TLS configuration (see config.py).")
set(MBEDTLS_CONFIG_SET "" CACHE STRING "Options to set, separated by semicolons (OPTION or OPTION=VALUE).") set(MBEDTLS_CONFIG_SET "" CACHE STRING "Options to set, separated by semicolons (OPTION or OPTION=VALUE).")
set(MBEDTLS_CONFIG_UNSET "" CACHE STRING "Options to unset, separated by semicolons.") set(MBEDTLS_CONFIG_UNSET "" CACHE STRING "Options to unset, separated by semicolons.")
@ -157,15 +157,9 @@ if(NOT "${MBEDTLS_CONFIG_FILE}" STREQUAL "" AND
endif() endif()
if(MBEDTLS_CONFIG_TRANSFORMED AND if(MBEDTLS_CONFIG_TRANSFORMED AND
(NOT "${TF_PSA_CRYPTO_CONFIG_FILE}" STREQUAL "" OR NOT "${TF_PSA_CRYPTO_CONFIG_FILE}" STREQUAL "")
NOT "${TF_PSA_CRYPTO_CONFIG_BASE_FILE}" STREQUAL "" OR
NOT "${TF_PSA_CRYPTO_CONFIG_NAME}" STREQUAL "" OR
NOT "${TF_PSA_CRYPTO_CONFIG_SET}" STREQUAL "" OR
NOT "${TF_PSA_CRYPTO_CONFIG_UNSET}" STREQUAL ""))
message(FATAL_ERROR message(FATAL_ERROR
"TF_PSA_CRYPTO_CONFIG_FILE, TF_PSA_CRYPTO_CONFIG_BASE_FILE, " "TF_PSA_CRYPTO_CONFIG_FILE cannot be combined with "
"TF_PSA_CRYPTO_CONFIG_NAME, TF_PSA_CRYPTO_CONFIG_SET and "
"TF_PSA_CRYPTO_CONFIG_UNSET cannot be combined with "
"MBEDTLS_CONFIG_NAME, MBEDTLS_CONFIG_SET or MBEDTLS_CONFIG_UNSET.") "MBEDTLS_CONFIG_NAME, MBEDTLS_CONFIG_SET or MBEDTLS_CONFIG_UNSET.")
endif() endif()
@ -188,13 +182,9 @@ if(NOT "${MBEDTLS_CONFIG_BASE_FILE}" STREQUAL "" OR
endif() endif()
if(NOT "${MBEDTLS_CONFIG_BASE_FILE}" STREQUAL "") if(NOT "${MBEDTLS_CONFIG_BASE_FILE}" STREQUAL "")
set(MBEDTLS_BASE_CONFIG_FILE "${MBEDTLS_CONFIG_BASE_FILE}") get_filename_component(MBEDTLS_BASE_CONFIG_FILE
if(NOT EXISTS "${MBEDTLS_BASE_CONFIG_FILE}") "${MBEDTLS_CONFIG_BASE_FILE}" ABSOLUTE
file(RELATIVE_PATH MBEDTLS_CONFIG_BASE_FILE_RELATIVE BASE_DIR "${CMAKE_CURRENT_SOURCE_DIR}")
"${CMAKE_CURRENT_BINARY_DIR}" "${MBEDTLS_CONFIG_BASE_FILE}")
set(MBEDTLS_BASE_CONFIG_FILE
"${CMAKE_CURRENT_SOURCE_DIR}/${MBEDTLS_CONFIG_BASE_FILE_RELATIVE}")
endif()
else() else()
set(MBEDTLS_BASE_CONFIG_FILE set(MBEDTLS_BASE_CONFIG_FILE
"${CMAKE_CURRENT_SOURCE_DIR}/include/mbedtls/mbedtls_config.h") "${CMAKE_CURRENT_SOURCE_DIR}/include/mbedtls/mbedtls_config.h")
@ -210,15 +200,25 @@ if(NOT "${MBEDTLS_CONFIG_BASE_FILE}" STREQUAL "" OR
"${MBEDTLS_GENERATED_CONFIG_FILE}" COPYONLY) "${MBEDTLS_GENERATED_CONFIG_FILE}" COPYONLY)
if(MBEDTLS_CONFIG_TRANSFORMED) if(MBEDTLS_CONFIG_TRANSFORMED)
if(NOT "${TF_PSA_CRYPTO_CONFIG_BASE_FILE}" STREQUAL "")
get_filename_component(MBEDTLS_BASE_CRYPTO_CONFIG_FILE
"${TF_PSA_CRYPTO_CONFIG_BASE_FILE}" ABSOLUTE
BASE_DIR "${CMAKE_CURRENT_SOURCE_DIR}")
else()
set(MBEDTLS_BASE_CRYPTO_CONFIG_FILE
"${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/include/psa/crypto_config.h")
endif()
if(NOT EXISTS "${MBEDTLS_BASE_CRYPTO_CONFIG_FILE}")
message(FATAL_ERROR
"TF-PSA-Crypto configuration file not found: "
"${MBEDTLS_BASE_CRYPTO_CONFIG_FILE}")
endif()
set(MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE set(MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE
"${MBEDTLS_GENERATED_CONFIG_DIR}/psa/crypto_config.h") "${MBEDTLS_GENERATED_CONFIG_DIR}/psa/crypto_config.h")
file(MAKE_DIRECTORY "${MBEDTLS_GENERATED_CONFIG_DIR}/psa") file(MAKE_DIRECTORY "${MBEDTLS_GENERATED_CONFIG_DIR}/psa")
# config.py handles the Mbed TLS and PSA configurations together. Give configure_file("${MBEDTLS_BASE_CRYPTO_CONFIG_FILE}"
# it a build-tree PSA configuration so that it never modifies the "${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}" COPYONLY)
# source tree.
configure_file(
"${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/include/psa/crypto_config.h"
"${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}" COPYONLY)
endif() endif()
function(mbedtls_configure_generated_file) function(mbedtls_configure_generated_file)
@ -257,8 +257,10 @@ if(NOT "${MBEDTLS_CONFIG_BASE_FILE}" STREQUAL "" OR
set(MBEDTLS_CONFIG_FILE set(MBEDTLS_CONFIG_FILE
"$<BUILD_INTERFACE:${MBEDTLS_GENERATED_CONFIG_FILE}>$<INSTALL_INTERFACE:mbedtls/mbedtls_config.h>") "$<BUILD_INTERFACE:${MBEDTLS_GENERATED_CONFIG_FILE}>$<INSTALL_INTERFACE:mbedtls/mbedtls_config.h>")
if(MBEDTLS_CONFIG_TRANSFORMED) if(MBEDTLS_CONFIG_TRANSFORMED)
set(TF_PSA_CRYPTO_CONFIG_FILE # TF-PSA-Crypto applies its own transformations after the PSA changes
"$<BUILD_INTERFACE:${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}>$<INSTALL_INTERFACE:psa/crypto_config_mbedtls.h>") # made by the Mbed TLS configuration tool.
set(TF_PSA_CRYPTO_CONFIG_BASE_FILE_OVERRIDE
"${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}")
endif() endif()
endif() endif()
@ -478,15 +480,6 @@ set(USE_STATIC_TF_PSA_CRYPTO_LIBRARY ${USE_STATIC_MBEDTLS_LIBRARY} CACHE BOOL ""
set(USE_SHARED_TF_PSA_CRYPTO_LIBRARY ${USE_SHARED_MBEDTLS_LIBRARY} CACHE BOOL "") set(USE_SHARED_TF_PSA_CRYPTO_LIBRARY ${USE_SHARED_MBEDTLS_LIBRARY} CACHE BOOL "")
add_subdirectory(tf-psa-crypto) add_subdirectory(tf-psa-crypto)
# Keep the generated configuration distinct from TF-PSA-Crypto's default
# configuration header, which is installed by the subproject.
if(NOT "${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}" STREQUAL "" AND
INSTALL_TF_PSA_CRYPTO_HEADERS)
install(FILES "${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}"
DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/psa
RENAME crypto_config_mbedtls.h)
endif()
set(tfpsacrypto_target "${TF_PSA_CRYPTO_TARGET_PREFIX}tfpsacrypto") set(tfpsacrypto_target "${TF_PSA_CRYPTO_TARGET_PREFIX}tfpsacrypto")
if (USE_STATIC_MBEDTLS_LIBRARY) if (USE_STATIC_MBEDTLS_LIBRARY)
set(tfpsacrypto_static_target ${tfpsacrypto_target}) set(tfpsacrypto_static_target ${tfpsacrypto_target})

59
tests/scripts/components-build-system.sh
View File

@ -320,6 +320,19 @@ component_build_cmake_config_options () {
cd "$MBEDTLS_ROOT_DIR" cd "$MBEDTLS_ROOT_DIR"
rm -rf "$OUT_OF_SOURCE_DIR" rm -rf "$OUT_OF_SOURCE_DIR"
launch_dir="$OUT_OF_SOURCE_DIR.launch"
mkdir "$launch_dir"
cd "$launch_dir"
msg "configure: resolve a relative base config from the source tree"
cmake -H"$MBEDTLS_ROOT_DIR" -B"$OUT_OF_SOURCE_DIR" \
-DMBEDTLS_CONFIG_BASE_FILE=configs/config-ccm-psk-tls1_2.h \
-DMBEDTLS_CONFIG_SET=MBEDTLS_DEBUG_C
grep '^#define MBEDTLS_DEBUG_C' \
"$OUT_OF_SOURCE_DIR/generated/include/mbedtls/mbedtls_config.h"
cd "$MBEDTLS_ROOT_DIR"
rm -rf "$OUT_OF_SOURCE_DIR" "$launch_dir"
mkdir "$OUT_OF_SOURCE_DIR" mkdir "$OUT_OF_SOURCE_DIR"
cd "$OUT_OF_SOURCE_DIR" cd "$OUT_OF_SOURCE_DIR"
@ -328,24 +341,36 @@ component_build_cmake_config_options () {
-DMBEDTLS_CONFIG_SET=MBEDTLS_DEBUG_C "$MBEDTLS_ROOT_DIR" -DMBEDTLS_CONFIG_SET=MBEDTLS_DEBUG_C "$MBEDTLS_ROOT_DIR"
cd "$MBEDTLS_ROOT_DIR" cd "$MBEDTLS_ROOT_DIR"
for option in \ rm -rf "$OUT_OF_SOURCE_DIR"
"TF_PSA_CRYPTO_CONFIG_FILE=$MBEDTLS_ROOT_DIR/tf-psa-crypto/include/psa/crypto_config.h" \ mkdir "$OUT_OF_SOURCE_DIR"
"TF_PSA_CRYPTO_CONFIG_BASE_FILE=$MBEDTLS_ROOT_DIR/tf-psa-crypto/include/psa/crypto_config.h" \ cd "$OUT_OF_SOURCE_DIR"
"TF_PSA_CRYPTO_CONFIG_NAME=full" \
"TF_PSA_CRYPTO_CONFIG_SET=PSA_WANT_ALG_SHA_256" \
"TF_PSA_CRYPTO_CONFIG_UNSET=PSA_WANT_ALG_CMAC"
do
rm -rf "$OUT_OF_SOURCE_DIR"
mkdir "$OUT_OF_SOURCE_DIR"
cd "$OUT_OF_SOURCE_DIR"
msg "configure: reject $option with Mbed TLS transformations" msg "configure: reject TF_PSA_CRYPTO_CONFIG_FILE with Mbed TLS transformations"
not cmake "-D$option" -DMBEDTLS_CONFIG_SET=MBEDTLS_DEBUG_C \ not cmake \
"$MBEDTLS_ROOT_DIR" -DTF_PSA_CRYPTO_CONFIG_FILE="$MBEDTLS_ROOT_DIR/tf-psa-crypto/include/psa/crypto_config.h" \
-DMBEDTLS_CONFIG_SET=MBEDTLS_DEBUG_C "$MBEDTLS_ROOT_DIR"
cd "$MBEDTLS_ROOT_DIR" cd "$MBEDTLS_ROOT_DIR"
done rm -rf "$OUT_OF_SOURCE_DIR"
mkdir "$OUT_OF_SOURCE_DIR"
cd "$OUT_OF_SOURCE_DIR"
msg "build: combine Mbed TLS and TF-PSA-Crypto transformations"
cmake \
-DMBEDTLS_CONFIG_BASE_FILE=configs/config-ccm-psk-tls1_2.h \
'-DMBEDTLS_CONFIG_SET=MBEDTLS_DEBUG_C;PSA_WANT_ALG_RIPEMD160' \
-DTF_PSA_CRYPTO_CONFIG_BASE_FILE="$MBEDTLS_ROOT_DIR/tf-psa-crypto/configs/crypto-config-symmetric-only.h" \
-DTF_PSA_CRYPTO_CONFIG_UNSET=PSA_WANT_ALG_RIPEMD160 \
"$MBEDTLS_ROOT_DIR"
make query_compile_time_config
programs/test/query_compile_time_config MBEDTLS_DEBUG_C
grep '^#define PSA_WANT_ALG_RIPEMD160' \
generated/include/psa/crypto_config.h
not programs/test/query_compile_time_config PSA_WANT_ALG_RIPEMD160
not programs/test/query_compile_time_config \
PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC
cd "$MBEDTLS_ROOT_DIR"
rm -rf "$OUT_OF_SOURCE_DIR" rm -rf "$OUT_OF_SOURCE_DIR"
mkdir "$OUT_OF_SOURCE_DIR" mkdir "$OUT_OF_SOURCE_DIR"
cd "$OUT_OF_SOURCE_DIR" cd "$OUT_OF_SOURCE_DIR"
@ -384,8 +409,8 @@ component_build_cmake_config_options () {
cmake --build . --target install cmake --build . --target install
cmp generated/include/mbedtls/mbedtls_config.h \ cmp generated/include/mbedtls/mbedtls_config.h \
"$install_dir/include/mbedtls/mbedtls_config.h" "$install_dir/include/mbedtls/mbedtls_config.h"
cmp generated/include/psa/crypto_config.h \ cmp tf-psa-crypto/include/psa/crypto_config.h \
"$install_dir/include/psa/crypto_config_mbedtls.h" "$install_dir/include/psa/crypto_config.h"
# The installed targets must not refer to the build tree. # The installed targets must not refer to the build tree.
cd "$MBEDTLS_ROOT_DIR" cd "$MBEDTLS_ROOT_DIR"