From bf650eeb88afe1d1a2e59eb02693f2a4e6b8647d Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 3 Jul 2025 13:21:38 +0100 Subject: [PATCH 1/6] Temporarily disable Werror Signed-off-by: Ben Taylor --- CMakeLists.txt | 9 --------- 1 file changed, 9 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 162373182..1e3c4910a 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -271,9 +271,6 @@ function(set_gnu_base_compile_options target) target_compile_options(${target} PRIVATE $<$:-Os>) target_compile_options(${target} PRIVATE $<$:-Os -Wcast-qual>) - if(MBEDTLS_FATAL_WARNINGS) - target_compile_options(${target} PRIVATE -Werror) - endif(MBEDTLS_FATAL_WARNINGS) endfunction(set_gnu_base_compile_options) function(set_clang_base_compile_options target) @@ -296,9 +293,6 @@ function(set_clang_base_compile_options target) set_target_properties(${target} PROPERTIES LINK_FLAGS_TSANDBG "-fsanitize=thread") target_compile_options(${target} PRIVATE $<$:-Os>) - if(MBEDTLS_FATAL_WARNINGS) - target_compile_options(${target} PRIVATE -Werror) - endif(MBEDTLS_FATAL_WARNINGS) endfunction(set_clang_base_compile_options) function(set_iar_base_compile_options target) @@ -306,9 +300,6 @@ function(set_iar_base_compile_options target) target_compile_options(${target} PRIVATE $<$:-Ohz>) target_compile_options(${target} PRIVATE $<$:--debug -On>) - if(MBEDTLS_FATAL_WARNINGS) - target_compile_options(${target} PRIVATE --warnings_are_errors) - endif(MBEDTLS_FATAL_WARNINGS) endfunction(set_iar_base_compile_options) function(set_msvc_base_compile_options target) From 04b03d7712badeaad673019277615c779b398d20 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 14 Jul 2025 09:46:18 +0100 Subject: [PATCH 2/6] Replace Werror removal with pragma Signed-off-by: Ben Taylor --- CMakeLists.txt | 9 +++++++++ library/ssl_tls12_client.c | 1 + library/ssl_tls13_generic.c | 1 + library/x509_crt.c | 2 ++ tests/suites/test_suite_x509write.function | 1 + 5 files changed, 14 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index 1e3c4910a..162373182 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -271,6 +271,9 @@ function(set_gnu_base_compile_options target) target_compile_options(${target} PRIVATE $<$:-Os>) target_compile_options(${target} PRIVATE $<$:-Os -Wcast-qual>) + if(MBEDTLS_FATAL_WARNINGS) + target_compile_options(${target} PRIVATE -Werror) + endif(MBEDTLS_FATAL_WARNINGS) endfunction(set_gnu_base_compile_options) function(set_clang_base_compile_options target) @@ -293,6 +296,9 @@ function(set_clang_base_compile_options target) set_target_properties(${target} PROPERTIES LINK_FLAGS_TSANDBG "-fsanitize=thread") target_compile_options(${target} PRIVATE $<$:-Os>) + if(MBEDTLS_FATAL_WARNINGS) + target_compile_options(${target} PRIVATE -Werror) + endif(MBEDTLS_FATAL_WARNINGS) endfunction(set_clang_base_compile_options) function(set_iar_base_compile_options target) @@ -300,6 +306,9 @@ function(set_iar_base_compile_options target) target_compile_options(${target} PRIVATE $<$:-Ohz>) target_compile_options(${target} PRIVATE $<$:--debug -On>) + if(MBEDTLS_FATAL_WARNINGS) + target_compile_options(${target} PRIVATE --warnings_are_errors) + endif(MBEDTLS_FATAL_WARNINGS) endfunction(set_iar_base_compile_options) function(set_msvc_base_compile_options target) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 2129da122..820cab17a 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -19,6 +19,7 @@ #include "psa_util_internal.h" #include "psa/crypto.h" +#pragma GCC diagnostic warning "-Wenum-conversion" #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) /* Define a local translating function to save code size by not using too many * arguments in each translating place. */ diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c index 372bf8460..cdf42128f 100644 --- a/library/ssl_tls13_generic.c +++ b/library/ssl_tls13_generic.c @@ -25,6 +25,7 @@ #include "psa/crypto.h" #include "psa_util_internal.h" +#pragma GCC diagnostic warning "-Wenum-conversion" #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED) /* Define a local translating function to save code size by not using too many diff --git a/library/x509_crt.c b/library/x509_crt.c index 3947eb09a..b6d95f534 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -17,6 +17,8 @@ * [SIRO] https://cabforum.org/wp-content/uploads/Chunghwatelecom201503cabforumV4.pdf */ +#pragma GCC diagnostic warning "-Wenum-conversion" + #include "x509_internal.h" #if defined(MBEDTLS_X509_CRT_PARSE_C) diff --git a/tests/suites/test_suite_x509write.function b/tests/suites/test_suite_x509write.function index e0aad90a0..5e3d470f5 100644 --- a/tests/suites/test_suite_x509write.function +++ b/tests/suites/test_suite_x509write.function @@ -14,6 +14,7 @@ #include #endif /* MBEDTLS_PK_HAVE_PRIVATE_HEADER */ #include "mbedtls/psa_util.h" +#pragma GCC diagnostic warning "-Wenum-conversion" #if defined(MBEDTLS_USE_PSA_CRYPTO) && \ defined(MBEDTLS_PEM_WRITE_C) && defined(MBEDTLS_X509_CSR_WRITE_C) From 1c1535f153fb46d95137b575fd57c310c7bf4dd7 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Wed, 16 Jul 2025 09:29:38 +0100 Subject: [PATCH 3/6] Make pragmas more specific Signed-off-by: Ben Taylor --- library/ssl_tls12_client.c | 2 +- library/ssl_tls13_generic.c | 4 +++- library/x509_crt.c | 2 -- tests/suites/test_suite_x509write.function | 1 - 4 files changed, 4 insertions(+), 5 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 820cab17a..21541b8fc 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -19,7 +19,6 @@ #include "psa_util_internal.h" #include "psa/crypto.h" -#pragma GCC diagnostic warning "-Wenum-conversion" #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) /* Define a local translating function to save code size by not using too many * arguments in each translating place. */ @@ -2086,6 +2085,7 @@ start_processing: ret = mbedtls_pk_verify_new(pk_alg, peer_pk, md_alg, hash, hashlen, p, sig_len); + #pragma GCC diagnostic pop } else #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */ ret = mbedtls_pk_verify_restartable(peer_pk, diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c index cdf42128f..cda1f8a42 100644 --- a/library/ssl_tls13_generic.c +++ b/library/ssl_tls13_generic.c @@ -25,7 +25,6 @@ #include "psa/crypto.h" #include "psa_util_internal.h" -#pragma GCC diagnostic warning "-Wenum-conversion" #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED) /* Define a local translating function to save code size by not using too many @@ -964,9 +963,12 @@ static int ssl_tls13_write_certificate_verify_body(mbedtls_ssl_context *ssl, MBEDTLS_SSL_DEBUG_BUF(3, "verify hash", verify_hash, verify_hash_len); + #pragma GCC diagnostic push + #pragma GCC diagnostic warning "-Wenum-conversion" if ((ret = mbedtls_pk_sign_ext(pk_type, own_key, md_alg, verify_hash, verify_hash_len, p + 4, (size_t) (end - (p + 4)), &signature_len)) != 0) { + #pragma GCC diagnostic pop MBEDTLS_SSL_DEBUG_MSG(2, ("CertificateVerify signature failed with %s", mbedtls_ssl_sig_alg_to_str(*sig_alg))); MBEDTLS_SSL_DEBUG_RET(2, "mbedtls_pk_sign_ext", ret); diff --git a/library/x509_crt.c b/library/x509_crt.c index b6d95f534..3947eb09a 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -17,8 +17,6 @@ * [SIRO] https://cabforum.org/wp-content/uploads/Chunghwatelecom201503cabforumV4.pdf */ -#pragma GCC diagnostic warning "-Wenum-conversion" - #include "x509_internal.h" #if defined(MBEDTLS_X509_CRT_PARSE_C) diff --git a/tests/suites/test_suite_x509write.function b/tests/suites/test_suite_x509write.function index 5e3d470f5..e0aad90a0 100644 --- a/tests/suites/test_suite_x509write.function +++ b/tests/suites/test_suite_x509write.function @@ -14,7 +14,6 @@ #include #endif /* MBEDTLS_PK_HAVE_PRIVATE_HEADER */ #include "mbedtls/psa_util.h" -#pragma GCC diagnostic warning "-Wenum-conversion" #if defined(MBEDTLS_USE_PSA_CRYPTO) && \ defined(MBEDTLS_PEM_WRITE_C) && defined(MBEDTLS_X509_CSR_WRITE_C) From d3ae1701f36db5c2c6282861ed48ec81cebb7588 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Wed, 23 Jul 2025 11:34:24 +0100 Subject: [PATCH 4/6] Remove pragmas and use alias Signed-off-by: Ben Taylor --- library/ssl_tls12_client.c | 2 +- library/ssl_tls13_generic.c | 3 --- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 21541b8fc..b882d47a5 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -2083,9 +2083,9 @@ start_processing: #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) if (pk_alg == MBEDTLS_PK_RSASSA_PSS) { ret = mbedtls_pk_verify_new(pk_alg, peer_pk, + peer_pk, md_alg, hash, hashlen, p, sig_len); - #pragma GCC diagnostic pop } else #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */ ret = mbedtls_pk_verify_restartable(peer_pk, diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c index cda1f8a42..372bf8460 100644 --- a/library/ssl_tls13_generic.c +++ b/library/ssl_tls13_generic.c @@ -963,12 +963,9 @@ static int ssl_tls13_write_certificate_verify_body(mbedtls_ssl_context *ssl, MBEDTLS_SSL_DEBUG_BUF(3, "verify hash", verify_hash, verify_hash_len); - #pragma GCC diagnostic push - #pragma GCC diagnostic warning "-Wenum-conversion" if ((ret = mbedtls_pk_sign_ext(pk_type, own_key, md_alg, verify_hash, verify_hash_len, p + 4, (size_t) (end - (p + 4)), &signature_len)) != 0) { - #pragma GCC diagnostic pop MBEDTLS_SSL_DEBUG_MSG(2, ("CertificateVerify signature failed with %s", mbedtls_ssl_sig_alg_to_str(*sig_alg))); MBEDTLS_SSL_DEBUG_RET(2, "mbedtls_pk_sign_ext", ret); From 73b39872911d477187fd2f7145a0b5bbfd07acd1 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Wed, 23 Jul 2025 14:38:47 +0100 Subject: [PATCH 5/6] Correct rebase and add in additional type cast Signed-off-by: Ben Taylor --- library/ssl_tls12_client.c | 1 - library/ssl_tls13_generic.c | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index b882d47a5..2129da122 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -2083,7 +2083,6 @@ start_processing: #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) if (pk_alg == MBEDTLS_PK_RSASSA_PSS) { ret = mbedtls_pk_verify_new(pk_alg, peer_pk, - peer_pk, md_alg, hash, hashlen, p, sig_len); } else diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c index 372bf8460..15731ca15 100644 --- a/library/ssl_tls13_generic.c +++ b/library/ssl_tls13_generic.c @@ -963,7 +963,7 @@ static int ssl_tls13_write_certificate_verify_body(mbedtls_ssl_context *ssl, MBEDTLS_SSL_DEBUG_BUF(3, "verify hash", verify_hash, verify_hash_len); - if ((ret = mbedtls_pk_sign_ext(pk_type, own_key, + if ((ret = mbedtls_pk_sign_ext((mbedtls_pk_sigalg_t) pk_type, own_key, md_alg, verify_hash, verify_hash_len, p + 4, (size_t) (end - (p + 4)), &signature_len)) != 0) { MBEDTLS_SSL_DEBUG_MSG(2, ("CertificateVerify signature failed with %s", From 7523b548e8400e37433a0bfada467444210fc8a2 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 28 Jul 2025 13:08:34 +0100 Subject: [PATCH 6/6] Update tf-psa-crypto submodule Signed-off-by: Ben Taylor --- tf-psa-crypto | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tf-psa-crypto b/tf-psa-crypto index 19edaa785..5df033ee3 160000 --- a/tf-psa-crypto +++ b/tf-psa-crypto @@ -1 +1 @@ -Subproject commit 19edaa785dd71ec8f0c9f72235243314c3d895fa +Subproject commit 5df033ee3cb9e0c05262bc57b821ca20b9483b54