Generate PSA_WANT_* for the Makefile build

.github/workflows/build-config-matrix.yml

@@ -92,12 +92,14 @@ jobs:
             modifiers: "-HAVE_ECC -HAVE_ECC_ENCRYPT"
           - name: rsa-1024
             modifiers: "-WOLFSSL_SP_1024 -RSA_MIN_SIZE +RSA_MIN_SIZE=2048"
-          # wolfPSA's own sources only: the bundled wolfCrypt sources do not
-          # build under WC_NO_RNG (asn.c trips -Wnonnull), which is a wolfSSL
-          # issue outside this lane's scope.
+          - name: no-rsa
+            modifiers: "+NO_RSA +ECC_USER_CURVES -WOLFSSL_HAVE_MLDSA"
           - name: no-rng
             modifiers: "+WC_NO_RNG +WC_BLINDING_NO_RNG_ACKNOWLEDGE_WEAKNESS"
             target: psa-objects
+          - name: no-filesystem
+            modifiers: "+NO_FILESYSTEM +WOLFPSA_CUSTOM_STORE"
+            target: libwolfpsa.a
 
     steps:
       - name: Check out wolfPSA
@@ -111,9 +113,10 @@ jobs:
       - name: Clone sibling wolfSSL
         run: git clone --depth 1 --branch ${{ matrix.wolfssl-ref }} https://github.com/wolfSSL/wolfssl ../wolfssl
 
+      # Builds the library, then runs the PSA_WANT_* surface test against it
       - name: Build ${{ matrix.config.name }}
         env:
-          BUILD_TARGET: ${{ matrix.config.target || 'libwolfpsa.so' }}
+          BUILD_TARGET: ${{ matrix.config.target || 'want-surface-test' }}
           # Fail on undefined symbols
           LDFLAGS: -Wl,-z,defs
         run: ./build-test/build-variant.sh "${{ matrix.config.name }}" ${{ matrix.config.modifiers }}

.github/workflows/test-psa-api.yml

@@ -65,6 +65,11 @@ jobs:
           ./test/psa_ecc_verify_curve_test
           ./test/psa_ecc_ecdh_curve_test
 
+      - name: Run the PSA_WANT surface test
+        run: |
+          make want-surface-test \
+            USER_SETTINGS_PATH="${GITHUB_WORKSPACE}/build-ecc-var"
+
   test-psa-api:
     runs-on: ubuntu-latest
     strategy:

.gitignore

@@ -85,3 +85,4 @@ test/psa_copy_key_cross_lifetime_test
 build-test/out/
 test/psa_zero_capacity_buffer_test
 test/psa_tf_psa_extra_test
+test/psa_want_surface_test

Makefile

@@ -82,7 +82,8 @@ WOLFCRYPT_OBJ_PIC := $(patsubst $(WOLFSSL_PATH)/wolfcrypt/src/%.c,$(OBJDIR_PIC)/
 WOLFSSL_CPPFLAGS ?= -DWOLFSSL_USER_SETTINGS
 
 CPPFLAGS += -I$(WOLFSSL_PATH) -I$(USER_SETTINGS_PATH) \
-	-I$(CURDIR) -I$(CURDIR)/wolfpsa -I$(CURDIR)/src $(WOLFSSL_CPPFLAGS)
+	-I$(CURDIR) -I$(CURDIR)/wolfpsa -I$(CURDIR)/src -I$(BUILD_DIR)/include \
+	$(WOLFSSL_CPPFLAGS)
 ifneq ($(strip $(PSA_INCLUDE)),)
 CPPFLAGS += -I$(PSA_INCLUDE)
 endif
@@ -118,7 +119,8 @@ CFLAGS += --coverage
 LDFLAGS += --coverage
 endif
 
-.PHONY: all clean psa-objects unit-run run-tests cov covclean
+.PHONY: all clean psa-objects unit-run run-tests cov covclean \
+	want-surface-test
 
 all: $(LIBNAME) $(SHLIBNAME)
 
@@ -135,6 +137,26 @@ $(LIBNAME): $(OBJ) $(WOLFCRYPT_OBJ)
 $(SHLIBNAME): $(OBJ_PIC) $(WOLFCRYPT_OBJ_PIC) $(EXPORT_MAP)
 	$(CC) -shared -Wl,--version-script,$(EXPORT_MAP) -Wl,-Bsymbolic-functions -o $@ $(filter-out $(EXPORT_MAP),$^) $(LDFLAGS)
 
+# Build the PSA_WANT_* macros based on what the wolfCrypt build supports.
+# Consumers of <psa/crypto.h> add $(BUILD_DIR)/include to the include path.
+PSA_CONFIG := $(BUILD_DIR)/include/crypto_config_generated.h
+PYTHON ?= python3
+
+$(PSA_CONFIG): FORCE
+	@mkdir -p $(dir $@)
+	$(PYTHON) tools/gen-crypto-config.py $@ "$(CC)" \
+		tools/psa_want_probe.c $(CPPFLAGS) $(CFLAGS)
+
+$(OBJ) $(OBJ_PIC) $(WOLFCRYPT_OBJ) $(WOLFCRYPT_OBJ_PIC): $(PSA_CONFIG)
+
+FORCE:
+
+want-surface-test: $(LIBNAME) $(SHLIBNAME)
+	$(CC) $(CPPFLAGS) $(CFLAGS) -o $(BUILD_DIR)/psa_want_surface_test \
+		test/psa_server/psa_want_surface_test.c $(LIBNAME) $(LDFLAGS) \
+		-lpthread -lm
+	$(BUILD_DIR)/psa_want_surface_test
+
 $(OBJDIR)/%.o: src/%.c
 	@mkdir -p $(OBJDIR)
 	$(CC) $(CPPFLAGS) $(DEPFLAGS) $(CFLAGS) -c $< -o $@
@@ -210,6 +232,7 @@ UNIT_TESTS := psa_api_test \
 	psa_import_zero_length_test \
 	psa_copy_key_cross_lifetime_test \
 	psa_zero_capacity_buffer_test \
+	psa_want_surface_test \
 	psa_tf_psa_extra_test
 
 # Run the unit test loop from the repo root (psa_rsa_pss_interop_test reads

README.md

@@ -66,6 +66,12 @@ You can override the wolfSSL source location:
 make wolfPSA WOLFSSL_PATH=~/src/wolfssl
 ```
 
+The build generates the `PSA_WANT_*` macros from the wolfCrypt configuration
+into `$(BUILD_DIR)/include/crypto_config_generated.h` (`build/include` by
+default), using python3. Set `PYTHON` to use another interpreter. Code that
+includes `<psa/crypto.h>` needs that directory on its include path next to
+`wolfpsa/`, and builds only after `make` has generated the header.
+
 ## Testing (PSA Architecture Test Suite)
 
 See `test-psa-api/README.md` for instructions on how to run the tests.

src/psa_key_storage.c

@@ -192,6 +192,7 @@ psa_status_t psa_asymmetric_export_public_key_ecc(psa_key_type_t key_type,
                                                   size_t *output_length);
 #endif
 
+#ifndef NO_RSA
 static psa_status_t psa_wc_error_to_psa_status(int ret)
 {
     psa_status_t status;
@@ -224,6 +225,7 @@ static psa_status_t psa_wc_error_to_psa_status(int ret)
 
     return status;
 }
+#endif /* !NO_RSA */
 
 static psa_status_t wolfpsa_validate_stored_key_data_length(size_t
                                                             key_data_length)

src/psa_tf_psa.c

@@ -34,6 +34,11 @@
 #include <wolfssl/wolfcrypt/memory.h>
 #include <wolfpsa/psa_engine.h>
 
+/* The generated crypto config must match the build's NO_FILESYSTEM */
+#if defined(MBEDTLS_FS_IO) == defined(NO_FILESYSTEM)
+    #error "MBEDTLS_FS_IO must be defined exactly when NO_FILESYSTEM is not"
+#endif
+
 void mbedtls_psa_crypto_free(void)
 {
     wolfPSA_CryptoCleanup();

test-psa-api/psa-crypto-tests.sh

@@ -8,7 +8,7 @@ PATCH_FILE="${SCRIPT_DIR}/psa-arch-tests_ec_overflow.patch"
 TARGET_NAME="tgt_dev_apis_wolfpsa"
 TARGET_SRC_DIR="${SCRIPT_DIR}/${TARGET_NAME}"
 TARGET_DST_DIR="${PSA_ARCH_TESTS_DIR}/api-tests/platform/targets/${TARGET_NAME}"
-PSA_INCLUDE_PATHS="${REPO_ROOT}/wolfpsa"
+PSA_INCLUDE_PATHS="${REPO_ROOT}/wolfpsa;${REPO_ROOT}/build/include"
 PSA_CRYPTO_LIB_FILENAME="${REPO_ROOT}/libwolfpsa.a"
 PSA_STORAGE_LIB_FILENAME=""
 PSA_ARCH_TESTS_REPO=${PSA_ARCH_TESTS_REPO:-"https://github.com/ARM-software/psa-arch-tests.git"}

test/Makefile

@@ -2,6 +2,11 @@ WOLFPSA_PATH ?= ..
 WOLFSSL_PATH ?= $(WOLFPSA_PATH)/../wolfssl
 WOLFPSA_ABS := $(abspath $(WOLFPSA_PATH))
 BUILD_DIR ?= build
+WOLFPSA_BUILD_DIR := $(WOLFPSA_ABS)/$(BUILD_DIR)
+ifneq ($(filter /%,$(BUILD_DIR)),)
+WOLFPSA_BUILD_DIR := $(BUILD_DIR)
+endif
+PSA_CONFIG := $(WOLFPSA_BUILD_DIR)/include/crypto_config_generated.h
 
 WOLFSSL_CANDIDATE_DIRS := \
 	$(WOLFSSL_PATH)/build \
@@ -56,6 +61,7 @@ ifneq ($(WOLFSSL_BUILD_DIR),)
 CPPFLAGS += -I$(WOLFSSL_BUILD_DIR)
 endif
 CPPFLAGS += -I$(WOLFPSA_PATH) -I$(WOLFPSA_PATH)/wolfpsa
+CPPFLAGS += -I$(WOLFPSA_BUILD_DIR)/include
 CPPFLAGS += -I$(WOLFPSA_PATH)/src
 CPPFLAGS += -I$(WOLFPSA_PATH)/test/psa_server
 
@@ -125,7 +131,8 @@ PSA_REGRESSION_TESTS = psa_aead_multipart_test \
 	psa_store_dir_validation_test \
 	psa_import_zero_length_test \
 	psa_copy_key_cross_lifetime_test \
-	psa_zero_capacity_buffer_test
+	psa_zero_capacity_buffer_test \
+	psa_want_surface_test
 BINARIES += $(PSA_REGRESSION_TESTS)
 
 # TF-PSA-Crypto extension tests, built with the default link recipe.
@@ -146,8 +153,8 @@ PSA_DES3_STACK_SCRUB_TEST_OBJS = psa_server/psa_des3_stack_scrub_test.o
 PSA_ECC_BIT_INFERENCE_TEST_OBJS = psa_server/psa_ecc_bit_inference_test.o
 PSA_ECC_CURVE_ID_TEST_OBJS = psa_server/psa_ecc_curve_id_test.o
 PSA_RANDOM_SIZE_TEST_OBJS = psa_server/psa_random_size_test.o
-PSA_ECC_CURVE_ID_TEST_DEPS = $(WOLFPSA_PATH)/$(BUILD_DIR)/obj/psa_asymmetric.o \
-	$(WOLFPSA_PATH)/$(BUILD_DIR)/obj/psa_pq.o
+PSA_ECC_CURVE_ID_TEST_DEPS = $(WOLFPSA_BUILD_DIR)/obj/psa_asymmetric.o \
+	$(WOLFPSA_BUILD_DIR)/obj/psa_pq.o
 PSA_RSA_PSS_TEST_OBJS = psa_server/psa_rsa_pss_interop_test.o
 
 .PHONY: all clean rebuild-wolfssl-psa require-wolfssl-lib FORCE
@@ -196,6 +203,9 @@ $(PSA_REGRESSION_TESTS) $(PSA_TF_PSA_TESTS): %: require-wolfssl-lib \
 		psa_server/%.o
 	$(CC) $(CFLAGS) -o $@ psa_server/$@.o $(LDFLAGS) $(LDLIBS) $(RPATH_WOLFPSA) $(RPATH_WOLFSSL)
 
+# Its expectations come from the library's PSA_WANT_* macros
+psa_server/psa_want_surface_test.o: $(wildcard $(PSA_CONFIG))
+
 ifdef WOLFSSL_HAS_PSA_TLS
 psa_tls_server: psa_server/psa_tls_server.o
 	$(CC) $(CFLAGS) -o $@ $^ $(LDFLAGS) $(LDLIBS) $(RPATH_WOLFPSA) $(RPATH_WOLFSSL)
@@ -213,7 +223,7 @@ CRYPTOCB_BUILD_DIR := $(abspath .)/build-cryptocb$(if $(SANITIZE_FLAGS),-asan)
 CRYPTOCB_LIB := $(CRYPTOCB_BUILD_DIR)/libwolfpsa-cryptocb.a
 CRYPTOCB_CPPFLAGS := -DWOLFSSL_USER_SETTINGS -DWOLF_CRYPTO_CB \
 	-I$(abspath $(WOLFSSL_PATH)) -I$(WOLFPSA_ABS) -I$(WOLFPSA_ABS)/wolfpsa \
-	-I$(WOLFPSA_ABS)/src
+	-I$(WOLFPSA_ABS)/src -I$(CRYPTOCB_BUILD_DIR)/include
 
 # FORCE, because only the sub-make knows whether a library source changed.
 # Without it make treats the existing archive as permanently up to date and
@@ -304,7 +314,8 @@ rebuild-wolfssl-psa: $(WOLFPSA_PATH)/libwolfpsa.so
 		--with-psa-lib="$(WOLFPSA_ABS)" \
 		--with-psa-lib-name=wolfpsa \
 		CFLAGS="-O2 $(DEBUG_FLAGS) $(SANITIZE_FLAGS)" \
-		CPPFLAGS="-DWOLFSSL_PSA_NO_RNG -DWOLFSSL_PSA_NO_HASH -DWOLFSSL_PSA_NO_AES" \
+		CPPFLAGS="-DWOLFSSL_PSA_NO_RNG -DWOLFSSL_PSA_NO_HASH -DWOLFSSL_PSA_NO_AES \
+			-I$(WOLFPSA_BUILD_DIR)/include" \
 		LDFLAGS="$(SANITIZE_FLAGS) -Wl,-rpath,$(WOLFPSA_ABS) -Wl,-rpath-link,$(WOLFPSA_ABS)"
 	$(MAKE) -C "$(WOLFSSL_PATH)" CFLAGS="-O2 $(DEBUG_FLAGS) $(SANITIZE_FLAGS)" LDFLAGS="$(SANITIZE_FLAGS) -Wl,-rpath,$(WOLFPSA_ABS) -Wl,-rpath-link,$(WOLFPSA_ABS)" src/libwolfssl.la