From c983869994d3151650fc358c79ccdb898721279e Mon Sep 17 00:00:00 2001 From: Aksel Skauge Mellbye Date: Wed, 17 Jun 2026 11:25:46 +0200 Subject: [PATCH 1/2] Add TF-PSA-Crypto dispatch include dir Add the TF-PSA-Crypto dispatch include directory to targets in the Mbed TLS build system that needs them. Use the CMake variable for the dispatch directory rather than hard-coding the path to allow using a custom dispatch directory with Mbed TLS. Signed-off-by: Aksel Skauge Mellbye --- CMakeLists.txt | 7 ++++++- doxygen/mbedtls.doxyfile | 4 ++-- framework | 2 +- library/CMakeLists.txt | 8 +++++--- programs/test/CMakeLists.txt | 6 ++++-- scripts/generate_query_config.pl | 1 + scripts/legacy.make | 3 +++ tests/scripts/depends.py | 1 + tests/scripts/test_config_checks.py | 1 + tf-psa-crypto | 2 +- 10 files changed, 25 insertions(+), 10 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index c6d076346c4..7d8376c359b 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -67,6 +67,9 @@ endif() # Set the project and framework root directory. set(MBEDTLS_DIR ${CMAKE_CURRENT_SOURCE_DIR}) set(MBEDTLS_FRAMEWORK_DIR ${CMAKE_CURRENT_SOURCE_DIR}/framework) +if(NOT DEFINED TF_PSA_CRYPTO_DISPATCH_DIR) + set(TF_PSA_CRYPTO_DISPATCH_DIR ${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/dispatch) +endif() option(ENABLE_PROGRAMS "Build Mbed TLS programs." ON) @@ -380,7 +383,7 @@ endforeach(target) # set(TF_PSA_CRYPTO_PRIVATE_INCLUDE_DIRS ${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/core - ${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/dispatch + ${TF_PSA_CRYPTO_DISPATCH_DIR} ${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src ${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/extras ${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/platform @@ -434,6 +437,7 @@ if(ENABLE_TESTING OR ENABLE_PROGRAMS) tests/include include tf-psa-crypto/include + ${TF_PSA_CRYPTO_DISPATCH_DIR}/include tf-psa-crypto/drivers/builtin/include tf-psa-crypto/drivers/everest/include tf-psa-crypto/drivers/pqcp/include @@ -471,6 +475,7 @@ if(ENABLE_TESTING OR ENABLE_PROGRAMS) tests/include include tf-psa-crypto/include + ${TF_PSA_CRYPTO_DISPATCH_DIR}/include tf-psa-crypto/drivers/builtin/include library tf-psa-crypto/drivers/everest/include diff --git a/doxygen/mbedtls.doxyfile b/doxygen/mbedtls.doxyfile index c6a5e4f4fd8..7fa5a8d7303 100644 --- a/doxygen/mbedtls.doxyfile +++ b/doxygen/mbedtls.doxyfile @@ -6,7 +6,7 @@ EXTRACT_ALL = YES EXTRACT_PRIVATE = YES EXTRACT_STATIC = YES CASE_SENSE_NAMES = NO -INPUT = ../include input ../tf-psa-crypto/include ../tests/include/alt-dummy +INPUT = ../include input ../tf-psa-crypto/include ../tf-psa-crypto/dispatch/include ../tests/include/alt-dummy FILE_PATTERNS = *.h EXCLUDE = ../tf-psa-crypto/include/mbedtls/private RECURSIVE = YES @@ -22,7 +22,7 @@ GENERATE_LATEX = NO GENERATE_XML = YES MACRO_EXPANSION = YES EXPAND_ONLY_PREDEF = YES -INCLUDE_PATH = ../include ../tf-psa-crypto/include ../tf-psa-crypto/drivers/builtin/include +INCLUDE_PATH = ../include ../tf-psa-crypto/include ../tf-psa-crypto/dispatch/include ../tf-psa-crypto/drivers/builtin/include EXPAND_AS_DEFINED = MBEDTLS_PRIVATE CLASS_DIAGRAMS = NO HAVE_DOT = YES diff --git a/framework b/framework index e92a8199665..957b8a1b749 160000 --- a/framework +++ b/framework @@ -1 +1 @@ -Subproject commit e92a81996656d82941a9afce843453c57e1d51f5 +Subproject commit 957b8a1b7492054a18eee5f20e3f7f626be06503 diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt index 5436a96d42e..01ca1f51a7f 100644 --- a/library/CMakeLists.txt +++ b/library/CMakeLists.txt @@ -234,13 +234,15 @@ endif(USE_SHARED_MBEDTLS_LIBRARY) foreach(target IN LISTS target_libraries) add_library(MbedTLS::${target} ALIAS ${target}) # add_subdirectory support - # Include public header files from /include, /tf-psa-crypto/include/ and - # tf-psa-crypto/drivers/builtin/include/. Include private header files - # from /library and ${TF_PSA_CRYPTO_PRIVATE_INCLUDE_DIRS}. + # Include public header files from /include, /tf-psa-crypto/include, + # /tf-psa-crypto/dispatch/include and /tf-psa-crypto/drivers/builtin/include. + # Include private header files from /library and + # ${TF_PSA_CRYPTO_PRIVATE_INCLUDE_DIRS}. target_include_directories(${target} PUBLIC $ $ $ + $ $ PRIVATE ${MBEDTLS_DIR}/library/ ${TF_PSA_CRYPTO_PRIVATE_INCLUDE_DIRS} diff --git a/programs/test/CMakeLists.txt b/programs/test/CMakeLists.txt index 0de71a9b032..28195ec1139 100644 --- a/programs/test/CMakeLists.txt +++ b/programs/test/CMakeLists.txt @@ -28,7 +28,8 @@ if(TEST_CPP) target_include_directories(cpp_dummy_build PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../include PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../tf-psa-crypto/include - PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../tf-psa-crypto/drivers/builtin/include) + PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../tf-psa-crypto/drivers/builtin/include + PRIVATE ${TF_PSA_CRYPTO_DISPATCH_DIR}/include) target_link_libraries(cpp_dummy_build ${tfpsacrypto_target} ${CMAKE_THREAD_LIBS_INIT}) endif() @@ -39,7 +40,8 @@ if(USE_SHARED_MBEDTLS_LIBRARY AND target_include_directories(dlopen PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../include PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../tf-psa-crypto/include - PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../tf-psa-crypto/drivers/builtin/include) + PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../tf-psa-crypto/drivers/builtin/include + PRIVATE ${TF_PSA_CRYPTO_DISPATCH_DIR}/include) target_link_libraries(dlopen ${CMAKE_DL_LIBS}) endif() diff --git a/scripts/generate_query_config.pl b/scripts/generate_query_config.pl index 99128ca7ac5..ac1d6be9d93 100755 --- a/scripts/generate_query_config.pl +++ b/scripts/generate_query_config.pl @@ -114,6 +114,7 @@ my @header_roots = qw( include tf-psa-crypto/include + tf-psa-crypto/dispatch/include tf-psa-crypto/drivers/builtin/include ); for my $root (@header_roots) { diff --git a/scripts/legacy.make b/scripts/legacy.make index 5726f9e82ad..63508b0fc5e 100644 --- a/scripts/legacy.make +++ b/scripts/legacy.make @@ -93,6 +93,7 @@ install: no_test cp -rp tf-psa-crypto/drivers/builtin/include/mbedtls $(DESTDIR)/include mkdir -p $(DESTDIR)/include/psa cp -rp tf-psa-crypto/include/psa $(DESTDIR)/include + cp -rp tf-psa-crypto/dispatch/include/psa $(DESTDIR)/include mkdir -p $(DESTDIR)/lib cp -RP library/libmbedtls.* $(DESTDIR)/lib @@ -172,6 +173,7 @@ C_SOURCE_FILES = $(wildcard \ library/*.[hc] \ tf-psa-crypto/core/*.[hc] \ tf-psa-crypto/include/*/*.h \ + tf-psa-crypto/dispatch/include/*/*.h \ tf-psa-crypto/drivers/*/include/*/*.h \ tf-psa-crypto/drivers/*/include/*/*/*.h \ tf-psa-crypto/drivers/*/include/*/*/*/*.h \ @@ -203,6 +205,7 @@ cscope: cscope.in.out cscope.po.out cscope.out cscope.in.out cscope.po.out cscope.out: $(C_SOURCE_FILES) cscope -bq -u -Iinclude -Ilibrary -Itf-psa-crypto/core \ -Itf-psa-crypto/include \ + -Itf-psa-crypto/dispatch/include \ -Itf-psa-crypto/drivers/builtin/src \ -Itf-psa-crypto/dispatch \ -Itf-psa-crypto/extras \ diff --git a/tests/scripts/depends.py b/tests/scripts/depends.py index 24f120b05e0..b9a7c5e1628 100755 --- a/tests/scripts/depends.py +++ b/tests/scripts/depends.py @@ -189,6 +189,7 @@ def _consistency_check(self): header += f'#error "{option}"\n' header += '#endif\n' include_path = ['include', 'tf-psa-crypto/include', + 'tf-psa-crypto/dispatch/include', 'tf-psa-crypto/drivers/builtin/include'] try: diff --git a/tests/scripts/test_config_checks.py b/tests/scripts/test_config_checks.py index 2c6f6b3c816..2f7a493d1e0 100755 --- a/tests/scripts/test_config_checks.py +++ b/tests/scripts/test_config_checks.py @@ -19,6 +19,7 @@ class MbedtlsTestConfigChecks(unittest_config_checks.TestConfigChecks): PROJECT_CONFIG_C = 'library/mbedtls_config.c' PROJECT_SPECIFIC_INCLUDE_DIRECTORIES = [ 'tf-psa-crypto/include', + 'tf-psa-crypto/dispatch/include', 'tf-psa-crypto/drivers/builtin/include', ] diff --git a/tf-psa-crypto b/tf-psa-crypto index 93fa04691f6..2de8d4e61c9 160000 --- a/tf-psa-crypto +++ b/tf-psa-crypto @@ -1 +1 @@ -Subproject commit 93fa04691f6d5628f51a369953856bf5bf75d31f +Subproject commit 2de8d4e61c9d9fbb60461fb3ed578077191b3e65 From 2cd9c1685b7c00920e086a95938dc2f44dd5d18e Mon Sep 17 00:00:00 2001 From: Aksel Skauge Mellbye Date: Wed, 17 Jun 2026 11:42:46 +0200 Subject: [PATCH 2/2] Add custom dispatch testcase using subproject Add a testcase for the use of TF_PSA_CRYPTO_DISPATCH_DIR to set a custom dispatch directory. The custom dispatch in the testcase is created by copying and generating the vanilla dispatch implementation into the test program directory. This test verifies that the Mbed TLS build system correctly forwards the dispatch directory configuration to the TF-PSA-Crypto build system and that the Mbed TLS build system doesn't hard-code any references to the default dispatch directory. Signed-off-by: Aksel Skauge Mellbye --- .../.gitignore | 5 ++++ .../CMakeLists.txt | 22 ++++++++++++++ .../cmake_subproject_dispatch.c | 30 +++++++++++++++++++ .../custom/CMakeLists.txt | 7 +++++ .../custom/custom_dispatch.c | 13 ++++++++ tests/scripts/components-build-system.sh | 23 ++++++++++++++ 6 files changed, 100 insertions(+) create mode 100644 programs/test/cmake_subproject_custom_dispatch/.gitignore create mode 100644 programs/test/cmake_subproject_custom_dispatch/CMakeLists.txt create mode 100644 programs/test/cmake_subproject_custom_dispatch/cmake_subproject_dispatch.c create mode 100644 programs/test/cmake_subproject_custom_dispatch/custom/CMakeLists.txt create mode 100644 programs/test/cmake_subproject_custom_dispatch/custom/custom_dispatch.c diff --git a/programs/test/cmake_subproject_custom_dispatch/.gitignore b/programs/test/cmake_subproject_custom_dispatch/.gitignore new file mode 100644 index 00000000000..b3ee3c7fec2 --- /dev/null +++ b/programs/test/cmake_subproject_custom_dispatch/.gitignore @@ -0,0 +1,5 @@ +build +custom/include +custom/psa_crypto_driver_wrappers* +Makefile +cmake_subproject_custom_dispatch diff --git a/programs/test/cmake_subproject_custom_dispatch/CMakeLists.txt b/programs/test/cmake_subproject_custom_dispatch/CMakeLists.txt new file mode 100644 index 00000000000..ab9a2d1f6cf --- /dev/null +++ b/programs/test/cmake_subproject_custom_dispatch/CMakeLists.txt @@ -0,0 +1,22 @@ +cmake_minimum_required(VERSION 3.5.1) + +# Test the target renaming support by adding a prefix to the targets built +set(MBEDTLS_TARGET_PREFIX subproject_test_) + +# We use the parent Mbed TLS directory as the MBEDTLS_DIR for this test. Other +# projects that use Mbed TLS as a subproject are likely to add by their own +# relative paths. +set(MBEDTLS_DIR ../../../) +# Use the local `custom` directory for the crypto dispatch implementation +set(TF_PSA_CRYPTO_DISPATCH_DIR ${CMAKE_CURRENT_LIST_DIR}/custom) + +# Add Mbed TLS as a subdirectory. +add_subdirectory(${MBEDTLS_DIR} build) + +add_executable(cmake_subproject_custom_dispatch cmake_subproject_dispatch.c) +target_link_libraries(cmake_subproject_custom_dispatch + subproject_test_mbedtls + subproject_test_mbedx509 + subproject_test_tfpsacrypto + ${CMAKE_THREAD_LIBS_INIT} +) diff --git a/programs/test/cmake_subproject_custom_dispatch/cmake_subproject_dispatch.c b/programs/test/cmake_subproject_custom_dispatch/cmake_subproject_dispatch.c new file mode 100644 index 00000000000..3c38664dc09 --- /dev/null +++ b/programs/test/cmake_subproject_custom_dispatch/cmake_subproject_dispatch.c @@ -0,0 +1,30 @@ +/* + * Simple program to test that CMake builds with Mbed TLS as a subdirectory + * work correctly. + * + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#include "mbedtls/build_info.h" + +#include "mbedtls/platform.h" + +#include "mbedtls/version.h" + +/* Verify that the dispatch implementation is the custom one by linking with + * a nonstandard symbol. Real custom dispatch implementations should not have + * nonstandard symbols. */ +int verify_custom_dispatch(void); + +/* The main reason to build this is for testing the CMake build, so the program + * doesn't need to do very much. It calls a single library function to ensure + * linkage works, but that is all. */ +int main() +{ + const char *version = mbedtls_version_get_string_full(); + + mbedtls_printf("Built against %s\n", version); + + return verify_custom_dispatch(); +} diff --git a/programs/test/cmake_subproject_custom_dispatch/custom/CMakeLists.txt b/programs/test/cmake_subproject_custom_dispatch/custom/CMakeLists.txt new file mode 100644 index 00000000000..12dcfc90fd3 --- /dev/null +++ b/programs/test/cmake_subproject_custom_dispatch/custom/CMakeLists.txt @@ -0,0 +1,7 @@ +list(APPEND dispatch_src_files + "${CMAKE_CURRENT_SOURCE_DIR}/custom_dispatch.c" + "${CMAKE_CURRENT_SOURCE_DIR}/psa_crypto_driver_wrappers_no_static.c" +) + +set(tf_psa_crypto_objlib "dispatch") +include(${PROJECT_SOURCE_DIR}/objlib.cmake) diff --git a/programs/test/cmake_subproject_custom_dispatch/custom/custom_dispatch.c b/programs/test/cmake_subproject_custom_dispatch/custom/custom_dispatch.c new file mode 100644 index 00000000000..2ab00fbffcc --- /dev/null +++ b/programs/test/cmake_subproject_custom_dispatch/custom/custom_dispatch.c @@ -0,0 +1,13 @@ +/* + * Dummy function to verify custom dispatch implementation + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +int verify_custom_dispatch(void); +int verify_custom_dispatch(void) +{ + return 0; +} diff --git a/tests/scripts/components-build-system.sh b/tests/scripts/components-build-system.sh index bf0262484e2..96d6496b891 100644 --- a/tests/scripts/components-build-system.sh +++ b/tests/scripts/components-build-system.sh @@ -104,6 +104,29 @@ support_test_cmake_as_subdirectory () { support_test_cmake_out_of_source } +component_test_cmake_as_subdirectory_custom_dispatch () { + # Remove existing generated files so that we use the ones CMake + # generates + $MAKE_COMMAND neat + + msg "build: custom dispatch with cmake 'as-subdirectory' build" + cp -r tf-psa-crypto/dispatch/include programs/test/cmake_subproject_custom_dispatch/custom + cp tf-psa-crypto/dispatch/psa_crypto_driver_wrappers_no_static.h programs/test/cmake_subproject_custom_dispatch/custom + mv tf-psa-crypto/dispatch tf-psa-crypto/dispatch.bak + tf-psa-crypto/scripts/generate_driver_wrappers.py programs/test/cmake_subproject_custom_dispatch/custom + cd programs/test/cmake_subproject_custom_dispatch + # Note: Explicitly generate files as these are turned off in releases + cmake -D GEN_FILES=ON . + make + ./cmake_subproject_custom_dispatch + cd ../../.. + mv tf-psa-crypto/dispatch.bak tf-psa-crypto/dispatch +} + +support_test_cmake_as_subdirectory_custom_dispatch () { + support_test_cmake_out_of_source +} + component_test_cmake_as_package () { # Remove existing generated files so that we use the ones CMake # generates