Documentation improvements
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
diff --git a/configs/config-tfm.h b/configs/config-tfm.h
index 64dce48..7ca83b6 100644
--- a/configs/config-tfm.h
+++ b/configs/config-tfm.h
@@ -1,7 +1,7 @@
/**
* \file config-tfm.h
*
- * \brief TF-M configuration with tweaks for a successful build and test.
+ * \brief TF-M medium profile, adapted to work on other platforms.
*/
/*
* Copyright The Mbed TLS Contributors
@@ -20,19 +20,26 @@
* limitations under the License.
*/
-/* TF-M Configuration Options */
-#include "../configs/ext/tfm_mbedcrypto_config_profile_medium.h"
+/* TF-M medium profile: mbedtls legacy configuration */
+#include "ext/tfm_mbedcrypto_config_profile_medium.h"
-/* TF-M PSA Crypto Configuration */
+/* TF-M medium profile: PSA crypto configuration */
#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "../configs/ext/crypto_config_profile_medium.h"
-/*****************************************************************************/
-/* Tweak configuration based on TF-M config for a successful build and test. */
-/*****************************************************************************/
+/***********************************************************/
+/* Tweak the configuration to remove dependencies on TF-M. */
+/***********************************************************/
-/* MBEDTLS_PSA_CRYPTO_SPM needs third party files, so disable it. */
+/* MBEDTLS_PSA_CRYPTO_SPM needs third-party files, so disable it. */
#undef MBEDTLS_PSA_CRYPTO_SPM
-/* TF-M provides its own (dummy) implemenations which Mbed TLS doesn't need. */
+
+/* TF-M provides its own dummy implementations to save code size.
+ * We don't have any way to disable the tests that need these feature,
+ * so we just keep AES decryption enabled. We will resolve this though
+ * an official way to disable AES decryption, then this deviation
+ * will no longer be needed:
+ * https://github.com/Mbed-TLS/mbedtls/issues/7368
+ */
#undef MBEDTLS_AES_SETKEY_DEC_ALT
#undef MBEDTLS_AES_DECRYPT_ALT
/* The configuration we have enables MBEDTLS_PK_PARSE_C and MBEDTLS_PK_WRITE_C
@@ -47,7 +54,10 @@
#undef MBEDTLS_PK_PARSE_C
#undef MBEDTLS_PK_WRITE_C
-/* Use built-in platform entropy functions. */
+/* Use built-in platform entropy functions (TF-M provides its own). */
#undef MBEDTLS_NO_PLATFORM_ENTROPY
-/* Disable buffer-based memory allocator */
+
+/* Disable buffer-based memory allocator. This isn't strictly required,
+ * but using the native allocator is faster and works better with
+ * memory management analysis frameworks such as ASan. */
#undef MBEDTLS_MEMORY_BUFFER_ALLOC_C