Cmake custom compile-time config support by yiwu0b11 · Pull Request #10860 · Mbed-TLS/mbedtls

yiwu0b11 · 2026-08-06T09:52:01Z

Add support for selecting and customizing compile-time configs in CMake with:

MBEDTLS_CONFIG_BASE_FILE
MBEDTLS_CONFIG_NAME
MBEDTLS_CONFIG_SET
MBEDTLS_CONFIG_UNSET

For example:

  cmake -S . -B build \
      -DMBEDTLS_CONFIG_BASE_FILE=configs/config-ccm-psk-tls1_2.h \
      -DMBEDTLS_CONFIG_UNSET=MBEDTLS_SSL_SRV_C \
      -DMBEDTLS_CONFIG_SET=MBEDTLS_SSL_RENEGOTIATION;MBEDTLS_DEBUG_C;MBEDTLS_ERROR_C

CMake copies the selected base config into the build tree before applying the transformations. The original file is not modified.

MBEDTLS_CONFIG_FILE still working as the config header passed and cannot be combined with the transformation options.

Generated Mbed TLS and PSA configs are also installed correctly, so installed CMake targets do not reference the producer build tree.

Depends on Mbed-TLS/TF-PSA-Crypto#868 for the PSA CMake config support.

PR checklist

changelog provided
framework PR not required
TF-PSA-Crypto development PR provided: CMake: add support for config options TF-PSA-Crypto#868
TF-PSA-Crypto 1.1 PR provided: TODO
mbedtls development PR provided: Here
mbedtls 4.1 PR provided: TODO
mbedtls 3.6 PR provided: [Backport 3.6] Cmake custom compile-time config support #10912
tests provided:

Signed-off-by: Yi Wu <yi.wu2@arm.com>

minosgalanakis

Good starting point but some minor comments to address

gilles-peskine-arm

The comments from my review of the crypto PR apply here (with some variations for the test part). In addition, I'm not sure how to tweak the crypto configuration when setting up an Mbed TLS build tree.

Signed-off-by: Yi Wu <yi.wu2@arm.com>

gilles-peskine-arm

LGTM except I don't see why you couldn't set both mbedtls and TF-PSA-Crypto options. For example, the CI does builds with both a different mbedtls base file and a different crypto base file.

Comments from my review of the crypto PR also apply.

Signed-off-by: Yi Wu <yi.wu2@arm.com>

gilles-peskine-arm

The last commit broke MBEDTLS_CONFIG_BASE_FILE with a relative path (AFAICT it did work before). And one test seems ineffective. LGTM otherwise.

gilles-peskine-arm · 2026-08-21T10:07:35Z

+
+    msg "configure: resolve a relative base config from the source tree"
+    cmake -H"$MBEDTLS_ROOT_DIR" -B"$OUT_OF_SOURCE_DIR" \
+        -DMBEDTLS_CONFIG_BASE_FILE=configs/config-ccm-psk-tls1_2.h \


This seems wrong. I would expect MBEDTLS_CONFIG_BASE_FILE to be relative to the current directory. (MBEDTLS_CONFIG_FILE is less intuitive, because the C macro is eventually relative to the install path, and it's not obvious how that relates to the source tree or the build tree.)

gilles-peskine-arm · 2026-08-21T10:10:31Z

+        -DTF_PSA_CRYPTO_CONFIG_BASE_FILE="$MBEDTLS_ROOT_DIR/tf-psa-crypto/configs/crypto-config-symmetric-only.h" \
+        -DTF_PSA_CRYPTO_CONFIG_UNSET=PSA_WANT_ALG_RIPEMD160 \


Why not use the designated crypto config file to use with configs/config-ccm-psk-tls1_2.h? E.g.

Suggested change

-DTF_PSA_CRYPTO_CONFIG_BASE_FILE="$MBEDTLS_ROOT_DIR/tf-psa-crypto/configs/crypto-config-symmetric-only.h" \

-DTF_PSA_CRYPTO_CONFIG_UNSET=PSA_WANT_ALG_RIPEMD160 \

-DTF_PSA_CRYPTO_CONFIG_BASE_FILE="$MBEDTLS_ROOT_DIR/tf-psa-crypto/configs/crypto-config-ccm-psk-tls1_2.h" \

-DTF_PSA_CRYPTO_CONFIG_UNSET=MBEDTLS_HAVE_TIME \

gilles-peskine-arm · 2026-08-21T10:13:13Z

 set(MBEDTLS_CONFIG_FILE "" CACHE FILEPATH "Mbed TLS config file (overrides default).")
 set(MBEDTLS_USER_CONFIG_FILE "" CACHE FILEPATH "Mbed TLS user config file (appended to default).")
-set(MBEDTLS_CONFIG_BASE_FILE "" CACHE FILEPATH "Mbed TLS config to copy and optionally transform.")
+set(MBEDTLS_CONFIG_BASE_FILE "" CACHE STRING "Mbed TLS config to copy and optionally transform.")


MBEDTLS_CONFIG_BASE_FILE is definitely a FILEPATH. It's a file that gets consumed by CMake. (Unlike MBEDTLS_CONFIG_FILE which is consumed by the C compiler and also meaningful after installation — that one might actually be a STRING, but changing that is out of scope here.)

gilles-peskine-arm · 2026-08-21T10:42:03Z

+    mkdir "$OUT_OF_SOURCE_DIR"
+    cd "$OUT_OF_SOURCE_DIR"
+
+    msg "build: combine Mbed TLS and TF-PSA-Crypto transformations"


I think this test is ineffective. Surely having a TF-PSA-Crypto transformation can only work when tf-psa-crypto has Mbed-TLS/TF-PSA-Crypto#868 ?

(But combining does seem to work if I check out the crypto PR in the submodule. With the caveat that TF_PSA_CRYPTO_CONFIG_BASE_FILE needs to be an absolute path on the current head, but it works with a relative path on 34538973d123e1995acf691606475bea205f1e0f.)

Signed-off-by: Yi Wu <yi.wu2@arm.com>

gilles-peskine-arm · 2026-08-21T12:09:08Z

The CI is unhappy

Signed-off-by: Yi Wu <yi.wu2@arm.com>

yiwu0b11 added 2 commits August 6, 2026 09:46

Cmake: add support for config options

160096a

Signed-off-by: Yi Wu <yi.wu2@arm.com>

add component test

bf92cc7

Signed-off-by: Yi Wu <yi.wu2@arm.com>

yiwu0b11 added enhancement needs-work needs-ci Needs to pass CI tests size-s Estimated task size: small (~2d) labels Aug 6, 2026

gilles-peskine-arm reviewed Aug 6, 2026

View reviewed changes

Comment thread CMakeLists.txt Outdated

CMake: support custom base configurations

346ece9

Signed-off-by: Yi Wu <yi.wu2@arm.com>

yiwu0b11 changed the title ~~Cmake config~~ Cmake custom compile-time config support Aug 7, 2026

yiwu0b11 mentioned this pull request Aug 10, 2026

[Backport 3.6] Cmake custom compile-time config support #10912

Open

7 tasks

yiwu0b11 added needs-review Every commit must be reviewed by at least two team members, needs-reviewer This PR needs someone to pick it up for review and removed needs-work needs-ci Needs to pass CI tests labels Aug 10, 2026

yiwu0b11 marked this pull request as ready for review August 10, 2026 08:32

yiwu0b11 added the priority-medium Medium priority - this can be reviewed as time permits label Aug 10, 2026

minosgalanakis self-requested a review August 11, 2026 15:09

yiwu0b11 mentioned this pull request Aug 11, 2026

CMake: add support for config options Mbed-TLS/TF-PSA-Crypto#868

Open

7 tasks

yiwu0b11 requested a review from gilles-peskine-arm August 12, 2026 13:52

gilles-peskine-arm removed the needs-reviewer This PR needs someone to pick it up for review label Aug 12, 2026

gilles-peskine-arm added this to Non-roadmap pull requests Aug 12, 2026

github-project-automation Bot moved this to In Development in Non-roadmap pull requests Aug 12, 2026

bjwtaylor reviewed Aug 13, 2026

View reviewed changes

Comment thread CMakeLists.txt Outdated

Comment thread CMakeLists.txt Outdated

minosgalanakis requested changes Aug 13, 2026

View reviewed changes

Comment thread CMakeLists.txt Outdated

Comment thread CMakeLists.txt Outdated

Comment thread tests/scripts/components-build-system.sh

gilles-peskine-arm requested changes Aug 13, 2026

View reviewed changes

Comment thread tests/scripts/components-build-system.sh Outdated

Comment thread tests/scripts/components-build-system.sh Outdated

Comment thread tests/scripts/components-build-system.sh

Comment thread CMakeLists.txt Outdated

gilles-peskine-arm added needs-work and removed needs-review Every commit must be reviewed by at least two team members, labels Aug 13, 2026

yiwu0b11 added 3 commits August 14, 2026 15:08

CMake: separate base config

1b5aabb

Signed-off-by: Yi Wu <yi.wu2@arm.com>

tests: cmake coverage improve

030f872

Signed-off-by: Yi Wu <yi.wu2@arm.com>

CMake: make generated configs relocatable

166c69a

Signed-off-by: Yi Wu <yi.wu2@arm.com>

yiwu0b11 added 2 commits August 14, 2026 17:23

test fixes: CMake 3.10 not support cmake -S -B

c734d57

Signed-off-by: Yi Wu <yi.wu2@arm.com>

compatible with PSA configs and test improvements

5c906f7

Signed-off-by: Yi Wu <yi.wu2@arm.com>

yiwu0b11 added needs-review Every commit must be reviewed by at least two team members, and removed needs-work labels Aug 19, 2026

yiwu0b11 requested review from bjwtaylor, gilles-peskine-arm and minosgalanakis August 20, 2026 07:55

bjwtaylor reviewed Aug 20, 2026

View reviewed changes

Comment thread CMakeLists.txt

gilles-peskine-arm requested changes Aug 20, 2026

View reviewed changes

Comment thread CMakeLists.txt Outdated

gilles-peskine-arm added needs-work and removed needs-review Every commit must be reviewed by at least two team members, labels Aug 20, 2026

CMake: combine Mbed TLS and PSA transformations

d180076

Signed-off-by: Yi Wu <yi.wu2@arm.com>

gilles-peskine-arm requested changes Aug 21, 2026

View reviewed changes

yiwu0b11 added the needs-preceding-pr Requires another PR to be merged first label Aug 21, 2026

CMake: restore FILEPATH from STING for base

ebbe61a

Signed-off-by: Yi Wu <yi.wu2@arm.com>

yiwu0b11 added 2 commits August 21, 2026 15:17

improve test coverage

8a7fdf2

Signed-off-by: Yi Wu <yi.wu2@arm.com>

Updated tf-psa-crypto submodule

ad93d46

Signed-off-by: Yi Wu <yi.wu2@arm.com>

		-DTF_PSA_CRYPTO_CONFIG_BASE_FILE="$MBEDTLS_ROOT_DIR/tf-psa-crypto/configs/crypto-config-symmetric-only.h" \
		-DTF_PSA_CRYPTO_CONFIG_UNSET=PSA_WANT_ALG_RIPEMD160 \

Uh oh!

Conversation

yiwu0b11 commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

minosgalanakis left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gilles-peskine-arm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gilles-peskine-arm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gilles-peskine-arm left a comment

Choose a reason for hiding this comment

Uh oh!

gilles-peskine-arm Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

gilles-peskine-arm Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

gilles-peskine-arm Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

gilles-peskine-arm Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

gilles-peskine-arm commented Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

yiwu0b11 commented Aug 6, 2026 •

edited

Loading