Merge pull request #9299 from ronald-cron-arm/move-mbedtls-crypto-headers

Move mbedtls crypto headers

3rdparty/everest/CMakeLists.txt

@@ -9,6 +9,7 @@ target_include_directories(${everest_target}
   PUBLIC $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
          $<BUILD_INTERFACE:${MBEDTLS_DIR}/include>
          $<BUILD_INTERFACE:${MBEDTLS_DIR}/tf-psa-crypto/include>
+         $<BUILD_INTERFACE:${MBEDTLS_DIR}/tf-psa-crypto/drivers/builtin/include>
          $<INSTALL_INTERFACE:include>
   PRIVATE include/everest
           include/everest/kremlib

3rdparty/p256-m/CMakeLists.txt

@@ -9,6 +9,7 @@ target_include_directories(${p256m_target}
          $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/p256-m>
          $<BUILD_INTERFACE:${MBEDTLS_DIR}/include>
          $<BUILD_INTERFACE:${MBEDTLS_DIR}/tf-psa-crypto/include>
+         $<BUILD_INTERFACE:${MBEDTLS_DIR}/tf-psa-crypto/drivers/builtin/include>
          $<INSTALL_INTERFACE:include>
   PRIVATE ${MBEDTLS_DIR}/library/)
 

CMakeLists.txt

@@ -356,6 +356,7 @@ if(ENABLE_TESTING OR ENABLE_PROGRAMS)
         PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/tests/include
         PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/include
         PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/include
+        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/include
         PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/library)
     # Request C11, needed for memory poisoning tests
     set_target_properties(mbedtls_test PROPERTIES C_STANDARD 11)
@@ -367,6 +368,7 @@ if(ENABLE_TESTING OR ENABLE_PROGRAMS)
         PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/tests/include
         PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/include
         PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/include
+        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/include
         PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/library
         PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/3rdparty/everest/include)
 

Makefile

@@ -95,6 +95,7 @@ ifndef WINDOWS
 install: no_test
 	mkdir -p $(DESTDIR)/include/mbedtls
 	cp -rp include/mbedtls $(DESTDIR)/include
+	cp -rp tf-psa-crypto/drivers/builtin/include/mbedtls $(DESTDIR)/include
 	mkdir -p $(DESTDIR)/include/psa
 	cp -rp tf-psa-crypto/include/psa $(DESTDIR)/include
 
@@ -198,6 +199,7 @@ C_SOURCE_FILES = $(wildcard \
 	include/*/*.h \
 	library/*.[hc] \
 	tf-psa-crypto/include/*/*.h \
+	tf-psa-crypto/drivers/builtin/include/*/*.h \
 	programs/*/*.[hc] \
 	tests/include/*/*.h tests/include/*/*/*.h \
 	tests/src/*.c tests/src/*/*.c \
@@ -214,5 +216,7 @@ GPATH GRTAGS GSYMS GTAGS: $(C_SOURCE_FILES)
 	ls $(C_SOURCE_FILES) | gtags -f - --gtagsconf .globalrc
 cscope: cscope.in.out cscope.po.out cscope.out
 cscope.in.out cscope.po.out cscope.out: $(C_SOURCE_FILES)
-	cscope -bq -u -Iinclude -Ilibrary -Itf-psa-crypto/include $(patsubst %,-I%,$(wildcard 3rdparty/*/include)) -Itests/include $(C_SOURCE_FILES)
+	cscope -bq -u -Iinclude -Ilibrary -Itf-psa-crypto/include \
+	-Itf-psa-crypto/drivers/builtin/include \
+	$(patsubst %,-I%,$(wildcard 3rdparty/*/include)) -Itests/include $(C_SOURCE_FILES)
 .PHONY: cscope global

doxygen/mbedtls.doxyfile

@@ -6,7 +6,7 @@ EXTRACT_ALL            = YES
 EXTRACT_PRIVATE        = YES
 EXTRACT_STATIC         = YES
 CASE_SENSE_NAMES       = NO
-INPUT                  = ../include ../tf-psa-crypto/include input ../tests/include/alt-dummy
+INPUT                  = ../include ../tf-psa-crypto/include input ../tf-psa-crypto/drivers/builtin/include ../tests/include/alt-dummy
 FILE_PATTERNS          = *.h
 RECURSIVE              = YES
 EXCLUDE_SYMLINKS       = YES
@@ -21,7 +21,7 @@ GENERATE_LATEX         = NO
 GENERATE_XML           = YES
 MACRO_EXPANSION        = YES
 EXPAND_ONLY_PREDEF     = YES
-INCLUDE_PATH           = ../include ../tf-psa-crypto/include
+INCLUDE_PATH           = ../include ../tf-psa-crypto/include ../tf-psa-crypto/drivers/builtin/include
 EXPAND_AS_DEFINED      = MBEDTLS_PRIVATE
 CLASS_DIAGRAMS         = NO
 HAVE_DOT               = YES

library/CMakeLists.txt

@@ -129,19 +129,22 @@ set(src_tls
 if(GEN_FILES)
     find_package(Perl REQUIRED)
 
-    file(GLOB error_headers ${CMAKE_CURRENT_SOURCE_DIR}/../include/mbedtls/*.h)
+    file(GLOB crypto_error_headers ${CMAKE_CURRENT_SOURCE_DIR}/../tf-psa-crypto/drivers/builtin/include/mbedtls/*.h)
+    file(GLOB tls_error_headers ${CMAKE_CURRENT_SOURCE_DIR}/../include/mbedtls/*.h)
     add_custom_command(
         OUTPUT
             ${CMAKE_CURRENT_BINARY_DIR}/error.c
         COMMAND
             ${PERL_EXECUTABLE}
                 ${CMAKE_CURRENT_SOURCE_DIR}/../scripts/generate_errors.pl
+                ${CMAKE_CURRENT_SOURCE_DIR}/../tf-psa-crypto/drivers/builtin/include/mbedtls
                 ${CMAKE_CURRENT_SOURCE_DIR}/../include/mbedtls
                 ${CMAKE_CURRENT_SOURCE_DIR}/../scripts/data_files
                 ${CMAKE_CURRENT_BINARY_DIR}/error.c
         DEPENDS
             ${CMAKE_CURRENT_SOURCE_DIR}/../scripts/generate_errors.pl
-            ${error_headers}
+            ${crypto_error_headers}
+            ${tls_error_headers}
             ${CMAKE_CURRENT_SOURCE_DIR}/../scripts/data_files/error.fmt
     )
 
@@ -170,7 +173,7 @@ if(GEN_FILES)
                 ${CMAKE_CURRENT_BINARY_DIR}
         DEPENDS
             ${CMAKE_CURRENT_SOURCE_DIR}/../scripts/generate_ssl_debug_helpers.py
-            ${error_headers}
+            ${tls_error_headers}
     )
 
     add_custom_command(
@@ -329,6 +332,7 @@ foreach(target IN LISTS target_libraries)
     target_include_directories(${target}
         PUBLIC $<BUILD_INTERFACE:${MBEDTLS_DIR}/include/>
                $<BUILD_INTERFACE:${MBEDTLS_DIR}/tf-psa-crypto/include/>
+               $<BUILD_INTERFACE:${MBEDTLS_DIR}/tf-psa-crypto/drivers/builtin/include/>
                $<INSTALL_INTERFACE:include/>
         PRIVATE ${MBEDTLS_DIR}/library/
                 # Needed to include psa_crypto_driver_wrappers.h

library/Makefile

@@ -28,11 +28,13 @@ CFLAGS	?= -O2
 WARNING_CFLAGS ?=  -Wall -Wextra -Wformat=2 -Wno-format-nonliteral
 LDFLAGS ?=
 
-# Include ../include, ../tf-psa-crypto/include for public headers and . for
+# Include ../include, ../tf-psa-crypto/include and
+# ../tf-psa-crypto/drivers/builtin/include for public headers and . for
 # private headers. Note that . needs to be included explicitly for the sake of
 # library files that are not in the /library directory (which currently means
 # under /3rdparty).
-LOCAL_CFLAGS = $(WARNING_CFLAGS) -I. -I../include -I../tf-psa-crypto/include -D_FILE_OFFSET_BITS=64
+LOCAL_CFLAGS = $(WARNING_CFLAGS) -I. -I../include -I../tf-psa-crypto/include \
+               -I../tf-psa-crypto/drivers/builtin/include -D_FILE_OFFSET_BITS=64
 LOCAL_LDFLAGS =
 
 ifdef DEBUG

programs/test/CMakeLists.txt

@@ -27,7 +27,8 @@ if(TEST_CPP)
     add_executable(cpp_dummy_build "${cpp_dummy_build_cpp}")
     target_include_directories(cpp_dummy_build
         PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../include
-        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../tf-psa-crypto/include)
+        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../tf-psa-crypto/include
+        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../tf-psa-crypto/drivers/builtin/include)
     target_link_libraries(cpp_dummy_build ${mbedcrypto_target} ${CMAKE_THREAD_LIBS_INIT})
 endif()
 
@@ -36,7 +37,8 @@ if(USE_SHARED_MBEDTLS_LIBRARY AND
     add_executable(dlopen "dlopen.c")
     target_include_directories(dlopen
         PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../include
-        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../tf-psa-crypto/include)
+        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../tf-psa-crypto/include
+        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../tf-psa-crypto/drivers/builtin/include)
     target_link_libraries(dlopen ${CMAKE_DL_LIBS})
 endif()
 

programs/test/generate_cpp_dummy_build.sh

@@ -45,6 +45,13 @@ EOF
         esac
     done
 
+    for header in tf-psa-crypto/drivers/builtin/include/mbedtls/*.h; do
+        case ${header#tf-psa-crypto/drivers/builtin/include/} in
+            mbedtls/config_*.h) :;; # not meant for direct inclusion
+            *) echo "#include \"${header#tf-psa-crypto/drivers/builtin/include/}\"";;
+        esac
+    done
+
     for header in tf-psa-crypto/include/psa/*.h; do
         case ${header#tf-psa-crypto/include/} in
             psa/crypto_config.h) :;; # not meant for direct inclusion

scripts/common.make

@@ -21,7 +21,10 @@ WARNING_CFLAGS ?= -Wall -Wextra -Wformat=2 -Wno-format-nonliteral
 WARNING_CXXFLAGS ?= -Wall -Wextra -Wformat=2 -Wno-format-nonliteral
 LDFLAGS ?=
 
-LOCAL_CFLAGS = $(WARNING_CFLAGS) -I$(MBEDTLS_TEST_PATH)/include -I$(MBEDTLS_PATH)/include -I$(MBEDTLS_PATH)/tf-psa-crypto/include -D_FILE_OFFSET_BITS=64
+LOCAL_CFLAGS = $(WARNING_CFLAGS) -I$(MBEDTLS_TEST_PATH)/include \
+               -I$(MBEDTLS_PATH)/include -I$(MBEDTLS_PATH)/tf-psa-crypto/include \
+               -I$(MBEDTLS_PATH)/tf-psa-crypto/drivers/builtin/include \
+               -D_FILE_OFFSET_BITS=64
 LOCAL_CXXFLAGS = $(WARNING_CXXFLAGS) -I$(MBEDTLS_PATH)/include -I$(MBEDTLS_PATH)/tests/include -D_FILE_OFFSET_BITS=64
 LOCAL_LDFLAGS = ${MBEDTLS_TEST_OBJS} 		\
 		-L$(MBEDTLS_PATH)/library			\

scripts/generate_errors.pl

@@ -3,7 +3,7 @@
 # Generate error.c
 #
 # Usage: ./generate_errors.pl or scripts/generate_errors.pl without arguments,
-# or generate_errors.pl include_dir data_dir error_file
+# or generate_errors.pl crypto_include_dir tls_include_dir data_dir error_file
 #
 # Copyright The Mbed TLS Contributors
 # SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
@@ -11,22 +11,24 @@
 use strict;
 use warnings;
 
-my ($include_dir, $data_dir, $error_file);
+my ($crypto_include_dir, $tls_include_dir, $data_dir, $error_file);
 
 if( @ARGV ) {
-    die "Invalid number of arguments" if scalar @ARGV != 3;
+    die "Invalid number of arguments" if scalar @ARGV != 4;
-    ($include_dir, $data_dir, $error_file) = @ARGV;
+    ($crypto_include_dir, $tls_include_dir, $data_dir, $error_file) = @ARGV;
 
-    -d $include_dir or die "No such directory: $include_dir\n";
+    -d $crypto_include_dir or die "No such directory: $crypto_include_dir\n";
+    -d $tls_include_dir or die "No such directory: $tls_include_dir\n";
     -d $data_dir or die "No such directory: $data_dir\n";
 } else {
-    $include_dir = 'include/mbedtls';
+    $crypto_include_dir = 'tf-psa-crypto/drivers/builtin/include/mbedtls';
+    $tls_include_dir = 'include/mbedtls';
     $data_dir = 'scripts/data_files';
     $error_file = 'library/error.c';
 
-    unless( -d $include_dir && -d $data_dir ) {
+    unless( -d $crypto_include_dir && -d $tls_include_dir && -d $data_dir ) {
         chdir '..' or die;
-        -d $include_dir && -d $data_dir
+        -d $crypto_include_dir && -d $tls_include_dir && -d $data_dir
             or die "Without arguments, must be run from root or scripts\n"
     }
 }
@@ -48,7 +50,8 @@ open(FORMAT_FILE, '<:crlf', "$error_format_file") or die "Opening error format f
 my $error_format = <FORMAT_FILE>;
 close(FORMAT_FILE);
 
-my @files = glob qq("$include_dir/*.h");
+my @files = glob qq("$crypto_include_dir/*.h");
+push(@files, glob qq("$tls_include_dir/*.h"));
 my @necessary_include_files;
 my @matches;
 foreach my $file (@files) {

scripts/generate_visualc_files.pl

@@ -23,6 +23,7 @@ my $vsx_sln_file = "$vsx_dir/mbedTLS.sln";
 
 my $programs_dir = 'programs';
 my $mbedtls_header_dir = 'include/mbedtls';
+my $drivers_builtin_header_dir = 'tf-psa-crypto/drivers/builtin/include/mbedtls';
 my $psa_header_dir = 'tf-psa-crypto/include/psa';
 my $source_dir = 'library';
 my $test_source_dir = 'tests/src';
@@ -45,6 +46,7 @@ my @thirdparty_source_dirs = qw(
 my @include_directories = qw(
     include
     tf-psa-crypto/include
+    tf-psa-crypto/drivers/builtin/include
     3rdparty/everest/include/
     3rdparty/everest/include/everest
     3rdparty/everest/include/everest/vs2013
@@ -102,6 +104,7 @@ sub check_dirs {
     }
     return -d $vsx_dir
         && -d $mbedtls_header_dir
+        && -d $drivers_builtin_header_dir
         && -d $psa_header_dir
         && -d $source_dir
         && -d $test_source_dir
@@ -258,6 +261,7 @@ sub main {
     my @app_list = get_app_list();
     my @header_dirs = (
                        $mbedtls_header_dir,
+                       $drivers_builtin_header_dir,
                        $psa_header_dir,
                        $test_header_dir,
                        $test_drivers_header_dir,

tests/Makefile

@@ -209,6 +209,8 @@ include/alt-extra/%_alt.h: ../include/%.h
 	perl -p -e 's/^(# *(define|ifndef) +\w+_)H\b/$${1}ALT_H/' $< >$@
 include/alt-extra/%_alt.h: ../tf-psa-crypto/include/%.h
 	perl -p -e 's/^(# *(define|ifndef) +\w+_)H\b/$${1}ALT_H/' $< >$@
+include/alt-extra/%_alt.h: ../tf-psa-crypto/drivers/builtin/include/%.h
+	perl -p -e 's/^(# *(define|ifndef) +\w+_)H\b/$${1}ALT_H/' $< >$@
 
 # Generate test library
 
@@ -217,7 +219,13 @@ include/alt-extra/%_alt.h: ../tf-psa-crypto/include/%.h
 # library. Add a LIBTESTDRIVER1_/libtestdriver1_ to mbedtls_xxx and psa_xxx
 # symbols.
 define libtestdriver1_rewrite :=
-	s!^(\s*#\s*include\s*[\"<])mbedtls/!$${1}libtestdriver1/include/mbedtls/!; \
+	s!^(\s*#\s*include\s*[\"<])mbedtls/build_info.h!$${1}libtestdriver1/include/mbedtls/build_info.h!; \
+	s!^(\s*#\s*include\s*[\"<])mbedtls/mbedtls_config.h!$${1}libtestdriver1/include/mbedtls/mbedtls_config.h!; \
+	s!^(\s*#\s*include\s*[\"<])mbedtls/config_adjust_legacy_crypto.h!$${1}libtestdriver1/include/mbedtls/config_adjust_legacy_crypto.h!; \
+	s!^(\s*#\s*include\s*[\"<])mbedtls/config_adjust_x509.h!$${1}libtestdriver1/include/mbedtls/config_adjust_x509.h!; \
+	s!^(\s*#\s*include\s*[\"<])mbedtls/config_adjust_ssl.h!$${1}libtestdriver1/include/mbedtls/config_adjust_ssl.h!; \
+	s!^(\s*#\s*include\s*[\"<])mbedtls/check_config.h!$${1}libtestdriver1/include/mbedtls/check_config.h!; \
+	s!^(\s*#\s*include\s*[\"<])mbedtls/!$${1}libtestdriver1/tf-psa-crypto/drivers/builtin/include/mbedtls/!; \
 	s!^(\s*#\s*include\s*[\"<])psa/!$${1}libtestdriver1/tf-psa-crypto/include/psa/!; \
 	next if /^\s*#\s*include/; \
 	s/\b(?=MBEDTLS_|PSA_)/LIBTESTDRIVER1_/g; \
@@ -255,6 +263,7 @@ libtestdriver1.a:
 	perl -pi -e '$(libtestdriver1_rewrite)' ./libtestdriver1/library/*.[ch]
 	perl -pi -e '$(libtestdriver1_rewrite)' ./libtestdriver1/include/*/*.h
 	perl -pi -e '$(libtestdriver1_rewrite)' ./libtestdriver1/tf-psa-crypto/include/*/*.h
+	perl -pi -e '$(libtestdriver1_rewrite)' ./libtestdriver1/tf-psa-crypto/drivers/builtin/include/*/*.h
 
 	$(MAKE) -C ./libtestdriver1/library CFLAGS="-I../../ $(CFLAGS)" LDFLAGS="$(LDFLAGS)" libmbedcrypto.a
 	cp ./libtestdriver1/library/libmbedcrypto.a ../library/libtestdriver1.a

tests/psa-client-server/psasim/Makefile

@@ -8,7 +8,9 @@ LIBPSACLIENT := -Llibpsaclient/ -lmbedcrypto -lmbedx509 -lmbedtls
 LIBPSASERVER := -Llibpsaserver/ -lmbedcrypto
 
 MBEDTLS_ROOT_PATH = ../../..
-COMMON_INCLUDE := -I./include -I$(MBEDTLS_ROOT_PATH)/include -I$(MBEDTLS_ROOT_PATH)/tf-psa-crypto/include
+COMMON_INCLUDE := -I./include -I$(MBEDTLS_ROOT_PATH)/include \
+                  -I$(MBEDTLS_ROOT_PATH)/tf-psa-crypto/include \
+                  -I$(MBEDTLS_ROOT_PATH)/tf-psa-crypto/drivers/builtin/include
 
 GENERATED_H_FILES =	include/psa_manifest/manifest.h \
 					include/psa_manifest/pid.h \

tests/scripts/check_names.py

@@ -239,6 +239,7 @@ class CodeParser():
             "include/mbedtls/*.h",
             "include/psa/*.h",
             "tf-psa-crypto/include/psa/*.h",
+            "tf-psa-crypto/drivers/builtin/include/mbedtls/*.h",
             "3rdparty/everest/include/everest/everest.h",
             "3rdparty/everest/include/everest/x25519.h"
         ])
@@ -253,6 +254,7 @@ class CodeParser():
             "include/mbedtls/*.h",
             "include/psa/*.h",
             "tf-psa-crypto/include/psa/*.h",
+            "tf-psa-crypto/drivers/builtin/include/mbedtls/*.h",
             "library/*.h",
             "library/*.c",
             "3rdparty/everest/include/everest/everest.h",
@@ -262,6 +264,7 @@ class CodeParser():
             "include/mbedtls/*.h",
             "include/psa/*.h",
             "tf-psa-crypto/include/psa/*.h",
+            "tf-psa-crypto/drivers/builtin/include/mbedtls/*.h",
             "library/*.h",
             "3rdparty/everest/include/everest/everest.h",
             "3rdparty/everest/include/everest/x25519.h"
@@ -270,6 +273,7 @@ class CodeParser():
             "include/mbedtls/*.h",
             "include/psa/*.h",
             "tf-psa-crypto/include/psa/*.h",
+            "tf-psa-crypto/drivers/builtin/include/mbedtls/*.h",
             "library/*.h",
             "3rdparty/everest/include/everest/everest.h",
             "3rdparty/everest/include/everest/x25519.h",

tests/scripts/depends.py

@@ -369,7 +369,11 @@ class CipherInfo: # pylint: disable=too-few-public-methods
     """Collect data about cipher.h."""
     def __init__(self):
         self.base_symbols = set()
-        with open('include/mbedtls/cipher.h', encoding="utf-8") as fh:
+        if os.path.isdir('tf-psa-crypto'):
+            cipher_h_path = 'tf-psa-crypto/drivers/builtin/include/mbedtls/cipher.h'
+        else:
+            cipher_h_path = 'include/mbedtls/cipher.h'
+        with open(cipher_h_path, encoding="utf-8") as fh:
             for line in fh:
                 m = re.match(r' *MBEDTLS_CIPHER_ID_(\w+),', line)
                 if m and m.group(1) not in ['NONE', 'NULL', '3DES']:

tests/scripts/test_psa_compliance.py

@@ -73,9 +73,14 @@ def main(library_build_dir: str):
         os.mkdir(build_dir)
         os.chdir(build_dir)
 
-        extra_includes = (';{}/drivers/builtin/include'.format(root_dir)
+        # Temporary while the PSA compliance test suite is still run as part
-                          if in_tf_psa_crypto_repo else
+        # of Mbed TLS testing. When it is not the case anymore, the second case
-                          ';{}/tf-psa-crypto/include'.format(root_dir))
+        # can be removed.
+        if in_tf_psa_crypto_repo:
+            extra_includes = ';{}/drivers/builtin/include'.format(root_dir)
+        elif os.path.isdir(os.path.join(root_dir, 'tf-psa-crypto')):
+            extra_includes = ';{}/tf-psa-crypto/include'.format(root_dir) + \
+                             (';{}/tf-psa-crypto/drivers/builtin/include'.format(root_dir))
 
         #pylint: disable=bad-continuation
         subprocess.check_call([

tests/scripts/test_psa_constant_names.py

@@ -161,7 +161,9 @@ TEST_SUITES = ['tests/suites/test_suite_psa_crypto_metadata.data']
 def main():
     parser = argparse.ArgumentParser(description=globals()['__doc__'])
     parser.add_argument('--include', '-I',
-                        action='append', default=['tf-psa-crypto/include', 'include'],
+                        action='append', default=['tf-psa-crypto/include',
+                                                  'tf-psa-crypto/drivers/builtin/include',
+                                                  'include'],
                         help='Directory for header files')
     parser.add_argument('--keep-c',
                         action='store_true', dest='keep_c', default=False,

tf-psa-crypto/include/CMakeLists.txt

@@ -1,14 +1,17 @@
-option(INSTALL_PSA_CRYPTO_HEADERS "Install PSA Crypto headers." ON)
+option(INSTALL_TF_PSA_CRYPTO_HEADERS "Install TF PSA Crypto headers." ON)
-
-if(INSTALL_PSA_CRYPTO_HEADERS)
 
+if(INSTALL_TF_PSA_CRYPTO_HEADERS)
     file(GLOB psa_headers "psa/*.h")
+    file(GLOB mbedtls_crypto_headers "../drivers/builtin/include/mbedtls/*.h")
 
     install(FILES ${psa_headers}
         DESTINATION include/psa
         PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
 
-endif(INSTALL_PSA_CRYPTO_HEADERS)
+    install(FILES ${mbedtls_crypto_headers}
+        DESTINATION include/mbedtls
+        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
+endif(INSTALL_TF_PSA_CRYPTO_HEADERS)
 
 # Make includes available in an out-of-source build. ssl-opt.sh requires it.
 if (ENABLE_TESTING AND NOT ${CMAKE_CURRENT_BINARY_DIR} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR})