初始提交：terminalX 可运行态（M0/M1/M1.5 已真机验证）

- M0: libghostty SSH 终端（渲染/输入/连接）+ 白屏修复(OutputGate) + 会话状态机/自动重连
- M1: tsnet 用户态组网 + SSH-over-tsnet(fd 桥)，shell 级真机验证；R5(Go+gvisor+C+++Swift 同进程) retire
- M1.5: tmux -CC 原生 tab（MVP）
- 结构: packages/(TXCore·TXTransport), apps/TerminalX, vendor/(libghostty-spm/libssh2/mbedtls/tsnet-bridge), artifacts/
- 文档: CLAUDE.md + docs/HANDOFF.md（新会话入口）
- 环境: 认证代理→依赖 vendor 本地化；Go 在 ~/.local/go；仅模拟器/未签名
- 待续: M2 mosh, tmux 多 pane, M4 安全(host key/SE)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vendor/mbedtls/scripts/abi_check.py

@@ -0,0 +1,16 @@
+#!/usr/bin/env python3
+"""Bridge script
+See framework/scripts/mbedtls_framework/interface_checks.py for detailed documentation.
+
+This is a convenient place to encode any branch-specific information we might want to add
+in the future.
+"""
+
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+import framework_scripts_path # pylint: disable=unused-import
+from mbedtls_framework import interface_checks
+
+if __name__ == "__main__":
+    interface_checks.run_main()

vendor/mbedtls/scripts/basic.requirements.txt

@@ -0,0 +1,5 @@
+# Python modules required to build Mbed TLS in ordinary conditions.
+
+# Required to (re-)generate source files. Not needed if the generated source
+# files are already present and up-to-date.
+-r driver.requirements.txt

vendor/mbedtls/scripts/bump_version.sh

@@ -0,0 +1,147 @@
+#!/bin/bash
+#
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+#
+# Purpose
+#
+# Sets the version numbers in the source code to those given.
+#
+# Usage: bump_version.sh [ --version <version> ] [ --so-crypto <version>]
+#                           [ --so-x509 <version> ] [ --so-tls <version> ]
+#                           [ -v | --verbose ] [ -h | --help ]
+#
+
+set -e
+
+VERSION=""
+
+# Parse arguments
+#
+until [ -z "$1" ]
+do
+  case "$1" in
+    --version)
+      # Version to use
+      shift
+      VERSION=$1
+      ;;
+    --so-crypto)
+      shift
+      SO_CRYPTO=$1
+      ;;
+    --so-x509)
+      shift
+      SO_X509=$1
+      ;;
+    --so-tls)
+      shift
+      SO_TLS=$1
+      ;;
+    -v|--verbose)
+      # Be verbose
+      VERBOSE="1"
+      ;;
+    -h|--help)
+      # print help
+      echo "Usage: $0"
+      echo -e "  -h|--help\t\tPrint this help."
+      echo -e "  --version <version>\tVersion to bump to."
+      echo -e "  --so-crypto <version>\tSO version to bump libmbedcrypto to."
+      echo -e "  --so-x509 <version>\tSO version to bump libmbedx509 to."
+      echo -e "  --so-tls <version>\tSO version to bump libmbedtls to."
+      echo -e "  -v|--verbose\t\tVerbose."
+      exit 0
+      ;;
+    *)
+      # print error
+      echo "Unknown argument: '$1'"
+      exit 1
+      ;;
+  esac
+  shift
+done
+
+if [ "X" = "X$VERSION" ];
+then
+  echo "No version specified. Unable to continue."
+  exit 1
+fi
+
+[ $VERBOSE ] && echo "Bumping VERSION in CMakeLists.txt"
+sed -e "s/ VERSION [0-9.]\{1,\}/ VERSION $VERSION/g" < CMakeLists.txt > tmp
+mv tmp CMakeLists.txt
+
+[ $VERBOSE ] && echo "Bumping VERSION in library/CMakeLists.txt"
+sed -e "s/ VERSION [0-9.]\{1,\}/ VERSION $VERSION/g" < library/CMakeLists.txt > tmp
+mv tmp library/CMakeLists.txt
+
+if [ "X" != "X$SO_CRYPTO" ];
+then
+  [ $VERBOSE ] && echo "Bumping SOVERSION for libmbedcrypto in library/CMakeLists.txt"
+  sed -e "/mbedcrypto/ s/ SOVERSION [0-9]\{1,\}/ SOVERSION $SO_CRYPTO/g" < library/CMakeLists.txt > tmp
+  mv tmp library/CMakeLists.txt
+
+  [ $VERBOSE ] && echo "Bumping SOVERSION for libmbedcrypto in library/Makefile"
+  sed -e "s/SOEXT_CRYPTO?=so.[0-9]\{1,\}/SOEXT_CRYPTO?=so.$SO_CRYPTO/g" < library/Makefile > tmp
+  mv tmp library/Makefile
+fi
+
+if [ "X" != "X$SO_X509" ];
+then
+  [ $VERBOSE ] && echo "Bumping SOVERSION for libmbedx509 in library/CMakeLists.txt"
+  sed -e "/mbedx509/ s/ SOVERSION [0-9]\{1,\}/ SOVERSION $SO_X509/g" < library/CMakeLists.txt > tmp
+  mv tmp library/CMakeLists.txt
+
+  [ $VERBOSE ] && echo "Bumping SOVERSION for libmbedx509 in library/Makefile"
+  sed -e "s/SOEXT_X509?=so.[0-9]\{1,\}/SOEXT_X509?=so.$SO_X509/g" < library/Makefile > tmp
+  mv tmp library/Makefile
+fi
+
+if [ "X" != "X$SO_TLS" ];
+then
+  [ $VERBOSE ] && echo "Bumping SOVERSION for libmbedtls in library/CMakeLists.txt"
+  sed -e "/mbedtls/ s/ SOVERSION [0-9]\{1,\}/ SOVERSION $SO_TLS/g" < library/CMakeLists.txt > tmp
+  mv tmp library/CMakeLists.txt
+
+  [ $VERBOSE ] && echo "Bumping SOVERSION for libmbedtls in library/Makefile"
+  sed -e "s/SOEXT_TLS?=so.[0-9]\{1,\}/SOEXT_TLS?=so.$SO_TLS/g" < library/Makefile > tmp
+  mv tmp library/Makefile
+fi
+
+[ $VERBOSE ] && echo "Bumping VERSION in include/mbedtls/build_info.h"
+read MAJOR MINOR PATCH <<<$(IFS="."; echo $VERSION)
+VERSION_NR="$( printf "0x%02X%02X%02X00" $MAJOR $MINOR $PATCH )"
+cat include/mbedtls/build_info.h |                                    \
+    sed -e "s/\(# *define  *[A-Z]*_VERSION\)_MAJOR .\{1,\}/\1_MAJOR  $MAJOR/" |    \
+    sed -e "s/\(# *define  *[A-Z]*_VERSION\)_MINOR .\{1,\}/\1_MINOR  $MINOR/" |    \
+    sed -e "s/\(# *define  *[A-Z]*_VERSION\)_PATCH .\{1,\}/\1_PATCH  $PATCH/" |    \
+    sed -e "s/\(# *define  *[A-Z]*_VERSION\)_NUMBER .\{1,\}/\1_NUMBER         $VERSION_NR/" |    \
+    sed -e "s/\(# *define  *[A-Z]*_VERSION\)_STRING .\{1,\}/\1_STRING         \"$VERSION\"/" |    \
+    sed -e "s/\(# *define  *[A-Z]*_VERSION\)_STRING_FULL .\{1,\}/\1_STRING_FULL    \"Mbed TLS $VERSION\"/" \
+    > tmp
+mv tmp include/mbedtls/build_info.h
+
+[ $VERBOSE ] && echo "Bumping version in tests/suites/test_suite_version.data"
+sed -e "s/version:\".\{1,\}/version:\"$VERSION\"/g" < tests/suites/test_suite_version.data > tmp
+mv tmp tests/suites/test_suite_version.data
+
+[ $VERBOSE ] && echo "Bumping PROJECT_NAME in doxygen/mbedtls.doxyfile and doxygen/input/doc_mainpage.h"
+for i in doxygen/mbedtls.doxyfile doxygen/input/doc_mainpage.h;
+do
+  sed -e "s/\\([Mm]bed TLS v\\)[0-9][0-9.]*/\\1$VERSION/g" < $i > tmp
+  mv tmp $i
+done
+
+[ $VERBOSE ] && echo "Re-generating library/error.c"
+scripts/generate_errors.pl
+
+[ $VERBOSE ] && echo "Re-generating programs/test/query_config.c"
+scripts/generate_query_config.pl
+
+[ $VERBOSE ] && echo "Re-generating library/version_features.c"
+scripts/generate_features.pl
+
+[ $VERBOSE ] && echo "Re-generating visualc files"
+scripts/generate_visualc_files.pl
+

vendor/mbedtls/scripts/ci.requirements.txt

@@ -0,0 +1,19 @@
+# Python package requirements for Mbed TLS testing.
+
+-r driver.requirements.txt
+-r ../framework/scripts/ci.requirements.txt
+
+# The dependencies below are only used in scripts that we run on the Linux CI.
+
+# Use a known version of Pylint, because new versions tend to add warnings
+# that could start rejecting our code.
+# 2.4.4 is the version in Ubuntu 20.04. It supports Python >=3.5.
+pylint == 2.4.4; platform_system == 'Linux'
+
+# Use a version of mypy that is compatible with our code base.
+# mypy <0.940 is known not to work: see commit
+#  :/Upgrade mypy to the last version supporting Python 3.6
+# mypy >=0.960 is known not to work:
+#   https://github.com/Mbed-TLS/mbedtls-framework/issues/50
+# mypy 0.942 is the version in Ubuntu 22.04.
+mypy == 0.942; platform_system == 'Linux'

vendor/mbedtls/scripts/code_size_compare.py

@@ -0,0 +1,953 @@
+#!/usr/bin/env python3
+
+"""
+This script is for comparing the size of the library files from two
+different Git revisions within an Mbed TLS repository.
+The results of the comparison is formatted as csv and stored at a
+configurable location.
+Note: must be run from Mbed TLS root.
+"""
+
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+import argparse
+import logging
+import os
+import re
+import shutil
+import subprocess
+import sys
+import typing
+from enum import Enum
+
+import framework_scripts_path # pylint: disable=unused-import
+from mbedtls_framework import build_tree
+from mbedtls_framework import logging_util
+from mbedtls_framework import typing_util
+
+class SupportedArch(Enum):
+    """Supported architecture for code size measurement."""
+    AARCH64 = 'aarch64'
+    AARCH32 = 'aarch32'
+    ARMV8_M = 'armv8-m'
+    X86_64 = 'x86_64'
+    X86 = 'x86'
+
+
+class SupportedConfig(Enum):
+    """Supported configuration for code size measurement."""
+    DEFAULT = 'default'
+    TFM_MEDIUM = 'tfm-medium'
+
+
+# Static library
+MBEDTLS_STATIC_LIB = {
+    'CRYPTO': 'library/libmbedcrypto.a',
+    'X509': 'library/libmbedx509.a',
+    'TLS': 'library/libmbedtls.a',
+}
+
+class CodeSizeDistinctInfo: # pylint: disable=too-few-public-methods
+    """Data structure to store possibly distinct information for code size
+    comparison."""
+    def __init__( #pylint: disable=too-many-arguments
+            self,
+            version: str,
+            git_rev: str,
+            arch: str,
+            config: str,
+            compiler: str,
+            opt_level: str,
+    ) -> None:
+        """
+        :param: version: which version to compare with for code size.
+        :param: git_rev: Git revision to calculate code size.
+        :param: arch: architecture to measure code size on.
+        :param: config: Configuration type to calculate code size.
+                        (See SupportedConfig)
+        :param: compiler: compiler used to build library/*.o.
+        :param: opt_level: Options that control optimization. (E.g. -Os)
+        """
+        self.version = version
+        self.git_rev = git_rev
+        self.arch = arch
+        self.config = config
+        self.compiler = compiler
+        self.opt_level = opt_level
+        # Note: Variables below are not initialized by class instantiation.
+        self.pre_make_cmd = [] #type: typing.List[str]
+        self.make_cmd = ''
+
+    def get_info_indication(self):
+        """Return a unique string to indicate Code Size Distinct Information."""
+        return '{git_rev}-{arch}-{config}-{compiler}'.format(**self.__dict__)
+
+
+class CodeSizeCommonInfo: # pylint: disable=too-few-public-methods
+    """Data structure to store common information for code size comparison."""
+    def __init__(
+            self,
+            host_arch: str,
+            measure_cmd: str,
+    ) -> None:
+        """
+        :param host_arch: host architecture.
+        :param measure_cmd: command to measure code size for library/*.o.
+        """
+        self.host_arch = host_arch
+        self.measure_cmd = measure_cmd
+
+    def get_info_indication(self):
+        """Return a unique string to indicate Code Size Common Information."""
+        return '{measure_tool}'\
+               .format(measure_tool=self.measure_cmd.strip().split(' ')[0])
+
+class CodeSizeResultInfo: # pylint: disable=too-few-public-methods
+    """Data structure to store result options for code size comparison."""
+    def __init__( #pylint: disable=too-many-arguments
+            self,
+            record_dir: str,
+            comp_dir: str,
+            with_markdown=False,
+            stdout=False,
+            show_all=False,
+    ) -> None:
+        """
+        :param record_dir: directory to store code size record.
+        :param comp_dir: directory to store results of code size comparision.
+        :param with_markdown: write comparision result into a markdown table.
+                              (Default: False)
+        :param stdout: direct comparison result into sys.stdout.
+                       (Default False)
+        :param show_all: show all objects in comparison result. (Default False)
+        """
+        self.record_dir = record_dir
+        self.comp_dir = comp_dir
+        self.with_markdown = with_markdown
+        self.stdout = stdout
+        self.show_all = show_all
+
+
+DETECT_ARCH_CMD = "cc -dM -E - < /dev/null"
+def detect_arch() -> str:
+    """Auto-detect host architecture."""
+    cc_output = subprocess.check_output(DETECT_ARCH_CMD, shell=True).decode()
+    if '__aarch64__' in cc_output:
+        return SupportedArch.AARCH64.value
+    if '__arm__' in cc_output:
+        return SupportedArch.AARCH32.value
+    if '__x86_64__' in cc_output:
+        return SupportedArch.X86_64.value
+    if '__i386__' in cc_output:
+        return SupportedArch.X86.value
+    else:
+        print("Unknown host architecture, cannot auto-detect arch.")
+        sys.exit(1)
+
+TFM_MEDIUM_CONFIG_H = 'configs/ext/tfm_mbedcrypto_config_profile_medium.h'
+TFM_MEDIUM_CRYPTO_CONFIG_H = 'configs/ext/crypto_config_profile_medium.h'
+
+CONFIG_H = 'include/mbedtls/mbedtls_config.h'
+CRYPTO_CONFIG_H = 'include/psa/crypto_config.h'
+BACKUP_SUFFIX = '.code_size.bak'
+
+class CodeSizeBuildInfo: # pylint: disable=too-few-public-methods
+    """Gather information used to measure code size.
+
+    It collects information about architecture, configuration in order to
+    infer build command for code size measurement.
+    """
+
+    SupportedArchConfig = [
+        '-a ' + SupportedArch.AARCH64.value + ' -c ' + SupportedConfig.DEFAULT.value,
+        '-a ' + SupportedArch.AARCH32.value + ' -c ' + SupportedConfig.DEFAULT.value,
+        '-a ' + SupportedArch.X86_64.value  + ' -c ' + SupportedConfig.DEFAULT.value,
+        '-a ' + SupportedArch.X86.value     + ' -c ' + SupportedConfig.DEFAULT.value,
+        '-a ' + SupportedArch.ARMV8_M.value + ' -c ' + SupportedConfig.TFM_MEDIUM.value,
+    ]
+
+    def __init__(
+            self,
+            size_dist_info: CodeSizeDistinctInfo,
+            host_arch: str,
+            logger: logging.Logger,
+    ) -> None:
+        """
+        :param size_dist_info:
+            CodeSizeDistinctInfo containing info for code size measurement.
+                - size_dist_info.arch: architecture to measure code size on.
+                - size_dist_info.config: configuration type to measure
+                                         code size with.
+                - size_dist_info.compiler: compiler used to build library/*.o.
+                - size_dist_info.opt_level: Options that control optimization.
+                                            (E.g. -Os)
+        :param host_arch: host architecture.
+        :param logger: logging module
+        """
+        self.arch = size_dist_info.arch
+        self.config = size_dist_info.config
+        self.compiler = size_dist_info.compiler
+        self.opt_level = size_dist_info.opt_level
+
+        self.make_cmd = ['make', '-j', 'lib']
+
+        self.host_arch = host_arch
+        self.logger = logger
+
+    def check_correctness(self) -> bool:
+        """Check whether we are using proper / supported combination
+        of information to build library/*.o."""
+
+        # default config
+        if self.config == SupportedConfig.DEFAULT.value and \
+            self.arch == self.host_arch:
+            return True
+        # TF-M
+        elif self.arch == SupportedArch.ARMV8_M.value and \
+             self.config == SupportedConfig.TFM_MEDIUM.value:
+            return True
+
+        return False
+
+    def infer_pre_make_command(self) -> typing.List[str]:
+        """Infer command to set up proper configuration before running make."""
+        pre_make_cmd = [] #type: typing.List[str]
+        if self.config == SupportedConfig.TFM_MEDIUM.value:
+            pre_make_cmd.append('cp {src} {dest}'
+                                .format(src=TFM_MEDIUM_CONFIG_H, dest=CONFIG_H))
+            pre_make_cmd.append('cp {src} {dest}'
+                                .format(src=TFM_MEDIUM_CRYPTO_CONFIG_H,
+                                        dest=CRYPTO_CONFIG_H))
+
+        return pre_make_cmd
+
+    def infer_make_cflags(self) -> str:
+        """Infer CFLAGS by instance attributes in CodeSizeDistinctInfo."""
+        cflags = [] #type: typing.List[str]
+
+        # set optimization level
+        cflags.append(self.opt_level)
+        # set compiler by config
+        if self.config == SupportedConfig.TFM_MEDIUM.value:
+            self.compiler = 'armclang'
+            cflags.append('-mcpu=cortex-m33')
+        # set target
+        if self.compiler == 'armclang':
+            cflags.append('--target=arm-arm-none-eabi')
+
+        return ' '.join(cflags)
+
+    def infer_make_command(self) -> str:
+        """Infer make command by CFLAGS and CC."""
+
+        if self.check_correctness():
+            # set CFLAGS=
+            self.make_cmd.append('CFLAGS=\'{}\''.format(self.infer_make_cflags()))
+            # set CC=
+            self.make_cmd.append('CC={}'.format(self.compiler))
+            return ' '.join(self.make_cmd)
+        else:
+            self.logger.error("Unsupported combination of architecture: {} " \
+                              "and configuration: {}.\n"
+                              .format(self.arch,
+                                      self.config))
+            self.logger.error("Please use supported combination of " \
+                             "architecture and configuration:")
+            for comb in CodeSizeBuildInfo.SupportedArchConfig:
+                self.logger.error(comb)
+            self.logger.error("")
+            self.logger.error("For your system, please use:")
+            for comb in CodeSizeBuildInfo.SupportedArchConfig:
+                if "default" in comb and self.host_arch not in comb:
+                    continue
+                self.logger.error(comb)
+            sys.exit(1)
+
+
+class CodeSizeCalculator:
+    """ A calculator to calculate code size of library/*.o based on
+    Git revision and code size measurement tool.
+    """
+
+    def __init__( #pylint: disable=too-many-arguments
+            self,
+            git_rev: str,
+            pre_make_cmd: typing.List[str],
+            make_cmd: str,
+            measure_cmd: str,
+            logger: logging.Logger,
+    ) -> None:
+        """
+        :param git_rev: Git revision. (E.g: commit)
+        :param pre_make_cmd: command to set up proper config before running make.
+        :param make_cmd: command to build library/*.o.
+        :param measure_cmd: command to measure code size for library/*.o.
+        :param logger: logging module
+        """
+        self.repo_path = "."
+        self.git_command = "git"
+        self.make_clean = 'make clean'
+
+        self.git_rev = git_rev
+        self.pre_make_cmd = pre_make_cmd
+        self.make_cmd = make_cmd
+        self.measure_cmd = measure_cmd
+        self.logger = logger
+
+    @staticmethod
+    def validate_git_revision(git_rev: str) -> str:
+        result = subprocess.check_output(["git", "rev-parse", "--verify",
+                                          git_rev + "^{commit}"],
+                                         shell=False, universal_newlines=True)
+        return result[:7]
+
+    def _create_git_worktree(self) -> str:
+        """Create a separate worktree for Git revision.
+        If Git revision is current, use current worktree instead."""
+
+        if self.git_rev == 'current':
+            self.logger.debug("Using current work directory.")
+            git_worktree_path = self.repo_path
+        else:
+            self.logger.debug("Creating git worktree for {}."
+                              .format(self.git_rev))
+            git_worktree_path = os.path.join(self.repo_path,
+                                             "temp-" + self.git_rev)
+            subprocess.check_output(
+                [self.git_command, "worktree", "add", "--detach",
+                 git_worktree_path, self.git_rev], cwd=self.repo_path,
+                stderr=subprocess.STDOUT
+            )
+
+        return git_worktree_path
+
+    @staticmethod
+    def backup_config_files(restore: bool) -> None:
+        """Backup / Restore config files."""
+        if restore:
+            shutil.move(CONFIG_H + BACKUP_SUFFIX, CONFIG_H)
+            shutil.move(CRYPTO_CONFIG_H + BACKUP_SUFFIX, CRYPTO_CONFIG_H)
+        else:
+            shutil.copy(CONFIG_H, CONFIG_H + BACKUP_SUFFIX)
+            shutil.copy(CRYPTO_CONFIG_H, CRYPTO_CONFIG_H + BACKUP_SUFFIX)
+
+    def _build_libraries(self, git_worktree_path: str) -> None:
+        """Build library/*.o in the specified worktree."""
+
+        self.logger.debug("Building library/*.o for {}."
+                          .format(self.git_rev))
+        my_environment = os.environ.copy()
+        try:
+            if self.git_rev == 'current':
+                self.backup_config_files(restore=False)
+            for pre_cmd in self.pre_make_cmd:
+                subprocess.check_output(
+                    pre_cmd, env=my_environment, shell=True,
+                    cwd=git_worktree_path, stderr=subprocess.STDOUT,
+                    universal_newlines=True
+                )
+            subprocess.check_output(
+                self.make_clean, env=my_environment, shell=True,
+                cwd=git_worktree_path, stderr=subprocess.STDOUT,
+                universal_newlines=True
+            )
+            subprocess.check_output(
+                self.make_cmd, env=my_environment, shell=True,
+                cwd=git_worktree_path, stderr=subprocess.STDOUT,
+                universal_newlines=True
+            )
+            if self.git_rev == 'current':
+                self.backup_config_files(restore=True)
+        except subprocess.CalledProcessError as e:
+            self._handle_called_process_error(e, git_worktree_path)
+
+    def _gen_raw_code_size(self, git_worktree_path: str) -> typing.Dict[str, str]:
+        """Measure code size by a tool and return in UTF-8 encoding."""
+
+        self.logger.debug("Measuring code size for {} by `{}`."
+                          .format(self.git_rev,
+                                  self.measure_cmd.strip().split(' ')[0]))
+
+        res = {}
+        for mod, st_lib in MBEDTLS_STATIC_LIB.items():
+            try:
+                result = subprocess.check_output(
+                    [self.measure_cmd + ' ' + st_lib], cwd=git_worktree_path,
+                    shell=True, universal_newlines=True
+                )
+                res[mod] = result
+            except subprocess.CalledProcessError as e:
+                self._handle_called_process_error(e, git_worktree_path)
+
+        return res
+
+    def _remove_worktree(self, git_worktree_path: str) -> None:
+        """Remove temporary worktree."""
+        if git_worktree_path != self.repo_path:
+            self.logger.debug("Removing temporary worktree {}."
+                              .format(git_worktree_path))
+            subprocess.check_output(
+                [self.git_command, "worktree", "remove", "--force",
+                 git_worktree_path], cwd=self.repo_path,
+                stderr=subprocess.STDOUT
+            )
+
+    def _handle_called_process_error(self, e: subprocess.CalledProcessError,
+                                     git_worktree_path: str) -> None:
+        """Handle a CalledProcessError and quit the program gracefully.
+        Remove any extra worktrees so that the script may be called again."""
+
+        # Tell the user what went wrong
+        self.logger.error(e, exc_info=True)
+        self.logger.error("Process output:\n {}".format(e.output))
+
+        # Quit gracefully by removing the existing worktree
+        self._remove_worktree(git_worktree_path)
+        sys.exit(-1)
+
+    def cal_libraries_code_size(self) -> typing.Dict[str, str]:
+        """Do a complete round to calculate code size of library/*.o
+        by measurement tool.
+
+        :return A dictionary of measured code size
+            - typing.Dict[mod: str]
+        """
+
+        git_worktree_path = self._create_git_worktree()
+        try:
+            self._build_libraries(git_worktree_path)
+            res = self._gen_raw_code_size(git_worktree_path)
+        finally:
+            self._remove_worktree(git_worktree_path)
+
+        return res
+
+
+class CodeSizeGenerator:
+    """ A generator based on size measurement tool for library/*.o.
+
+    This is an abstract class. To use it, derive a class that implements
+    write_record and write_comparison methods, then call both of them with
+    proper arguments.
+    """
+    def __init__(self, logger: logging.Logger) -> None:
+        """
+        :param logger: logging module
+        """
+        self.logger = logger
+
+    def write_record(
+            self,
+            git_rev: str,
+            code_size_text: typing.Dict[str, str],
+            output: typing_util.Writable
+    ) -> None:
+        """Write size record into a file.
+
+        :param git_rev: Git revision. (E.g: commit)
+        :param code_size_text:
+            string output (utf-8) from measurement tool of code size.
+                - typing.Dict[mod: str]
+        :param output: output stream which the code size record is written to.
+                       (Note: Normally write code size record into File)
+        """
+        raise NotImplementedError
+
+    def write_comparison( #pylint: disable=too-many-arguments
+            self,
+            old_rev: str,
+            new_rev: str,
+            output: typing_util.Writable,
+            with_markdown=False,
+            show_all=False
+    ) -> None:
+        """Write a comparision result into a stream between two Git revisions.
+
+        :param old_rev: old Git revision to compared with.
+        :param new_rev: new Git revision to compared with.
+        :param output: output stream which the code size record is written to.
+                       (File / sys.stdout)
+        :param with_markdown:  write comparision result in a markdown table.
+                               (Default: False)
+        :param show_all: show all objects in comparison result. (Default False)
+        """
+        raise NotImplementedError
+
+
+class CodeSizeGeneratorWithSize(CodeSizeGenerator):
+    """Code Size Base Class for size record saving and writing."""
+
+    class SizeEntry: # pylint: disable=too-few-public-methods
+        """Data Structure to only store information of code size."""
+        def __init__(self, text: int, data: int, bss: int, dec: int):
+            self.text = text
+            self.data = data
+            self.bss = bss
+            self.total = dec # total <=> dec
+
+    def __init__(self, logger: logging.Logger) -> None:
+        """ Variable code_size is used to store size info for any Git revisions.
+        :param code_size:
+            Data Format as following:
+            code_size = {
+                git_rev: {
+                    module: {
+                        file_name: SizeEntry,
+                        ...
+                    },
+                    ...
+                },
+                ...
+            }
+        """
+        super().__init__(logger)
+        self.code_size = {} #type: typing.Dict[str, typing.Dict]
+        self.mod_total_suffix = '-' + 'TOTALS'
+
+    def _set_size_record(self, git_rev: str, mod: str, size_text: str) -> None:
+        """Store size information for target Git revision and high-level module.
+
+        size_text Format: text data bss dec hex filename
+        """
+        size_record = {}
+        for line in size_text.splitlines()[1:]:
+            data = line.split()
+            if re.match(r'\s*\(TOTALS\)', data[5]):
+                data[5] = mod + self.mod_total_suffix
+            # file_name: SizeEntry(text, data, bss, dec)
+            size_record[data[5]] = CodeSizeGeneratorWithSize.SizeEntry(
+                int(data[0]), int(data[1]), int(data[2]), int(data[3]))
+        self.code_size.setdefault(git_rev, {}).update({mod: size_record})
+
+    def read_size_record(self, git_rev: str, fname: str) -> None:
+        """Read size information from csv file and write it into code_size.
+
+        fname Format: filename text data bss dec
+        """
+        mod = ""
+        size_record = {}
+        with open(fname, 'r') as csv_file:
+            for line in csv_file:
+                data = line.strip().split()
+                # check if we find the beginning of a module
+                if data and data[0] in MBEDTLS_STATIC_LIB:
+                    mod = data[0]
+                    continue
+
+                if mod:
+                    # file_name: SizeEntry(text, data, bss, dec)
+                    size_record[data[0]] = CodeSizeGeneratorWithSize.SizeEntry(
+                        int(data[1]), int(data[2]), int(data[3]), int(data[4]))
+
+                # check if we hit record for the end of a module
+                m = re.match(r'\w+' + self.mod_total_suffix, line)
+                if m:
+                    if git_rev in self.code_size:
+                        self.code_size[git_rev].update({mod: size_record})
+                    else:
+                        self.code_size[git_rev] = {mod: size_record}
+                    mod = ""
+                    size_record = {}
+
+    def write_record(
+            self,
+            git_rev: str,
+            code_size_text: typing.Dict[str, str],
+            output: typing_util.Writable
+    ) -> None:
+        """Write size information to a file.
+
+        Writing Format: filename text data bss total(dec)
+        """
+        for mod, size_text in code_size_text.items():
+            self._set_size_record(git_rev, mod, size_text)
+
+        format_string = "{:<30} {:>7} {:>7} {:>7} {:>7}\n"
+        output.write(format_string.format("filename",
+                                          "text", "data", "bss", "total"))
+
+        for mod, f_size in self.code_size[git_rev].items():
+            output.write("\n" + mod + "\n")
+            for fname, size_entry in f_size.items():
+                output.write(format_string
+                             .format(fname,
+                                     size_entry.text, size_entry.data,
+                                     size_entry.bss, size_entry.total))
+
+    def write_comparison( #pylint: disable=too-many-arguments
+            self,
+            old_rev: str,
+            new_rev: str,
+            output: typing_util.Writable,
+            with_markdown=False,
+            show_all=False
+    ) -> None:
+        # pylint: disable=too-many-locals
+        """Write comparison result into a file.
+
+        Writing Format:
+            Markdown Output:
+                filename new(text) new(data) change(text) change(data)
+            CSV Output:
+                filename new(text) new(data) old(text) old(data) change(text) change(data)
+        """
+        header_line = ["filename", "new(text)", "old(text)", "change(text)",
+                       "new(data)", "old(data)", "change(data)"]
+        if with_markdown:
+            dash_line = [":----", "----:", "----:", "----:",
+                         "----:", "----:", "----:"]
+            # | filename | new(text) | new(data) | change(text) | change(data) |
+            line_format = "| {0:<30} | {1:>9} | {4:>9} | {3:>12} | {6:>12} |\n"
+            bold_text = lambda x: '**' + str(x) + '**'
+        else:
+            # filename new(text) new(data) old(text) old(data) change(text) change(data)
+            line_format = "{0:<30} {1:>9} {4:>9} {2:>10} {5:>10} {3:>12} {6:>12}\n"
+
+        def cal_sect_change(
+                old_size: typing.Optional[CodeSizeGeneratorWithSize.SizeEntry],
+                new_size: typing.Optional[CodeSizeGeneratorWithSize.SizeEntry],
+                sect: str
+        ) -> typing.List:
+            """Inner helper function to calculate size change for a section.
+
+            Convention for special cases:
+                - If the object has been removed in new Git revision,
+                  the size is minus code size of old Git revision;
+                  the size change is marked as `Removed`,
+                - If the object only exists in new Git revision,
+                  the size is code size of new Git revision;
+                  the size change is marked as `None`,
+
+            :param: old_size: code size for objects in old Git revision.
+            :param: new_size: code size for objects in new Git revision.
+            :param: sect: section to calculate from `size` tool. This could be
+                          any instance variable in SizeEntry.
+            :return: List of [section size of objects for new Git revision,
+                     section size of objects for old Git revision,
+                     section size change of objects between two Git revisions]
+            """
+            if old_size and new_size:
+                new_attr = new_size.__dict__[sect]
+                old_attr = old_size.__dict__[sect]
+                delta = new_attr - old_attr
+                change_attr = '{0:{1}}'.format(delta, '+' if delta else '')
+            elif old_size:
+                new_attr = 'Removed'
+                old_attr = old_size.__dict__[sect]
+                delta = - old_attr
+                change_attr = '{0:{1}}'.format(delta, '+' if delta else '')
+            elif new_size:
+                new_attr = new_size.__dict__[sect]
+                old_attr = 'NotCreated'
+                delta = new_attr
+                change_attr = '{0:{1}}'.format(delta, '+' if delta else '')
+            else:
+                # Should never happen
+                new_attr = 'Error'
+                old_attr = 'Error'
+                change_attr = 'Error'
+            return [new_attr, old_attr, change_attr]
+
+        # sort dictionary by key
+        sort_by_k = lambda item: item[0].lower()
+        def get_results(
+                f_rev_size:
+                typing.Dict[str,
+                            typing.Dict[str,
+                                        CodeSizeGeneratorWithSize.SizeEntry]]
+            ) -> typing.List:
+            """Return List of results in the format of:
+            [filename, new(text), old(text), change(text),
+             new(data), old(data), change(data)]
+            """
+            res = []
+            for fname, revs_size in sorted(f_rev_size.items(), key=sort_by_k):
+                old_size = revs_size.get(old_rev)
+                new_size = revs_size.get(new_rev)
+
+                text_sect = cal_sect_change(old_size, new_size, 'text')
+                data_sect = cal_sect_change(old_size, new_size, 'data')
+                # skip the files that haven't changed in code size
+                if not show_all and text_sect[-1] == '0' and data_sect[-1] == '0':
+                    continue
+
+                res.append([fname, *text_sect, *data_sect])
+            return res
+
+        # write header
+        output.write(line_format.format(*header_line))
+        if with_markdown:
+            output.write(line_format.format(*dash_line))
+        for mod in MBEDTLS_STATIC_LIB:
+        # convert self.code_size to:
+        # {
+        #   file_name: {
+        #       old_rev: SizeEntry,
+        #       new_rev: SizeEntry
+        #   },
+        #   ...
+        # }
+            f_rev_size = {} #type: typing.Dict[str, typing.Dict]
+            for fname, size_entry in self.code_size[old_rev][mod].items():
+                f_rev_size.setdefault(fname, {}).update({old_rev: size_entry})
+            for fname, size_entry in self.code_size[new_rev][mod].items():
+                f_rev_size.setdefault(fname, {}).update({new_rev: size_entry})
+
+            mod_total_sz = f_rev_size.pop(mod + self.mod_total_suffix)
+            res = get_results(f_rev_size)
+            total_clm = get_results({mod + self.mod_total_suffix: mod_total_sz})
+            if with_markdown:
+                # bold row of mod-TOTALS in markdown table
+                total_clm = [[bold_text(j) for j in i] for i in total_clm]
+            res += total_clm
+
+            # write comparison result
+            for line in res:
+                output.write(line_format.format(*line))
+
+
+class CodeSizeComparison:
+    """Compare code size between two Git revisions."""
+
+    def __init__( #pylint: disable=too-many-arguments
+            self,
+            old_size_dist_info: CodeSizeDistinctInfo,
+            new_size_dist_info: CodeSizeDistinctInfo,
+            size_common_info: CodeSizeCommonInfo,
+            result_options: CodeSizeResultInfo,
+            logger: logging.Logger,
+    ) -> None:
+        """
+        :param old_size_dist_info: CodeSizeDistinctInfo containing old distinct
+                                   info to compare code size with.
+        :param new_size_dist_info: CodeSizeDistinctInfo containing new distinct
+                                   info to take as comparision base.
+        :param size_common_info: CodeSizeCommonInfo containing common info for
+                                 both old and new size distinct info and
+                                 measurement tool.
+        :param result_options: CodeSizeResultInfo containing results options for
+                               code size record and comparision.
+        :param logger: logging module
+        """
+
+        self.logger = logger
+
+        self.old_size_dist_info = old_size_dist_info
+        self.new_size_dist_info = new_size_dist_info
+        self.size_common_info = size_common_info
+        # infer pre make command
+        self.old_size_dist_info.pre_make_cmd = CodeSizeBuildInfo(
+            self.old_size_dist_info, self.size_common_info.host_arch,
+            self.logger).infer_pre_make_command()
+        self.new_size_dist_info.pre_make_cmd = CodeSizeBuildInfo(
+            self.new_size_dist_info, self.size_common_info.host_arch,
+            self.logger).infer_pre_make_command()
+        # infer make command
+        self.old_size_dist_info.make_cmd = CodeSizeBuildInfo(
+            self.old_size_dist_info, self.size_common_info.host_arch,
+            self.logger).infer_make_command()
+        self.new_size_dist_info.make_cmd = CodeSizeBuildInfo(
+            self.new_size_dist_info, self.size_common_info.host_arch,
+            self.logger).infer_make_command()
+        # initialize size parser with corresponding measurement tool
+        self.code_size_generator = self.__generate_size_parser()
+
+        self.result_options = result_options
+        self.csv_dir = os.path.abspath(self.result_options.record_dir)
+        os.makedirs(self.csv_dir, exist_ok=True)
+        self.comp_dir = os.path.abspath(self.result_options.comp_dir)
+        os.makedirs(self.comp_dir, exist_ok=True)
+
+    def __generate_size_parser(self):
+        """Generate a parser for the corresponding measurement tool."""
+        if re.match(r'size', self.size_common_info.measure_cmd.strip()):
+            return CodeSizeGeneratorWithSize(self.logger)
+        else:
+            self.logger.error("Unsupported measurement tool: `{}`."
+                              .format(self.size_common_info.measure_cmd
+                                      .strip().split(' ')[0]))
+            sys.exit(1)
+
+    def cal_code_size(
+            self,
+            size_dist_info: CodeSizeDistinctInfo
+        ) -> typing.Dict[str, str]:
+        """Calculate code size of library/*.o in a UTF-8 encoding"""
+
+        return CodeSizeCalculator(size_dist_info.git_rev,
+                                  size_dist_info.pre_make_cmd,
+                                  size_dist_info.make_cmd,
+                                  self.size_common_info.measure_cmd,
+                                  self.logger).cal_libraries_code_size()
+
+    def gen_code_size_report(self, size_dist_info: CodeSizeDistinctInfo) -> None:
+        """Generate code size record and write it into a file."""
+
+        self.logger.info("Start to generate code size record for {}."
+                         .format(size_dist_info.git_rev))
+        output_file = os.path.join(
+            self.csv_dir,
+            '{}-{}.csv'
+            .format(size_dist_info.get_info_indication(),
+                    self.size_common_info.get_info_indication()))
+        # Check if the corresponding record exists
+        if size_dist_info.git_rev != "current" and \
+           os.path.exists(output_file):
+            self.logger.debug("Code size csv file for {} already exists."
+                              .format(size_dist_info.git_rev))
+            self.code_size_generator.read_size_record(
+                size_dist_info.git_rev, output_file)
+        else:
+            # measure code size
+            code_size_text = self.cal_code_size(size_dist_info)
+
+            self.logger.debug("Generating code size csv for {}."
+                              .format(size_dist_info.git_rev))
+            output = open(output_file, "w")
+            self.code_size_generator.write_record(
+                size_dist_info.git_rev, code_size_text, output)
+
+    def gen_code_size_comparison(self) -> None:
+        """Generate results of code size changes between two Git revisions,
+        old and new.
+
+        - Measured code size result of these two Git revisions must be available.
+        - The result is directed into either file / stdout depending on
+          the option, size_common_info.result_options.stdout. (Default: file)
+        """
+
+        self.logger.info("Start to generate comparision result between "\
+                         "{} and {}."
+                         .format(self.old_size_dist_info.git_rev,
+                                 self.new_size_dist_info.git_rev))
+        if self.result_options.stdout:
+            output = sys.stdout
+        else:
+            output_file = os.path.join(
+                self.comp_dir,
+                '{}-{}-{}.{}'
+                .format(self.old_size_dist_info.get_info_indication(),
+                        self.new_size_dist_info.get_info_indication(),
+                        self.size_common_info.get_info_indication(),
+                        'md' if self.result_options.with_markdown else 'csv'))
+            output = open(output_file, "w")
+
+        self.logger.debug("Generating comparison results between {} and {}."
+                          .format(self.old_size_dist_info.git_rev,
+                                  self.new_size_dist_info.git_rev))
+        if self.result_options.with_markdown or self.result_options.stdout:
+            print("Measure code size between {} and {} by `{}`."
+                  .format(self.old_size_dist_info.get_info_indication(),
+                          self.new_size_dist_info.get_info_indication(),
+                          self.size_common_info.get_info_indication()),
+                  file=output)
+        self.code_size_generator.write_comparison(
+            self.old_size_dist_info.git_rev,
+            self.new_size_dist_info.git_rev,
+            output, self.result_options.with_markdown,
+            self.result_options.show_all)
+
+    def get_comparision_results(self) -> None:
+        """Compare size of library/*.o between self.old_size_dist_info and
+        self.old_size_dist_info and generate the result file."""
+        build_tree.check_repo_path()
+        self.gen_code_size_report(self.old_size_dist_info)
+        self.gen_code_size_report(self.new_size_dist_info)
+        self.gen_code_size_comparison()
+
+def main():
+    parser = argparse.ArgumentParser(description=(__doc__))
+    group_required = parser.add_argument_group(
+        'required arguments',
+        'required arguments to parse for running ' + os.path.basename(__file__))
+    group_required.add_argument(
+        '-o', '--old-rev', type=str, required=True,
+        help='old Git revision for comparison.')
+
+    group_optional = parser.add_argument_group(
+        'optional arguments',
+        'optional arguments to parse for running ' + os.path.basename(__file__))
+    group_optional.add_argument(
+        '--record-dir', type=str, default='code_size_records',
+        help='directory where code size record is stored. '
+             '(Default: code_size_records)')
+    group_optional.add_argument(
+        '--comp-dir', type=str, default='comparison',
+        help='directory where comparison result is stored. '
+             '(Default: comparison)')
+    group_optional.add_argument(
+        '-n', '--new-rev', type=str, default='current',
+        help='new Git revision as comparison base. '
+             '(Default is the current work directory, including uncommitted '
+             'changes.)')
+    group_optional.add_argument(
+        '-a', '--arch', type=str, default=detect_arch(),
+        choices=list(map(lambda s: s.value, SupportedArch)),
+        help='Specify architecture for code size comparison. '
+             '(Default is the host architecture.)')
+    group_optional.add_argument(
+        '-c', '--config', type=str, default=SupportedConfig.DEFAULT.value,
+        choices=list(map(lambda s: s.value, SupportedConfig)),
+        help='Specify configuration type for code size comparison. '
+             '(Default is the current Mbed TLS configuration.)')
+    group_optional.add_argument(
+        '--markdown', action='store_true', dest='markdown',
+        help='Show comparision of code size in a markdown table. '
+             '(Only show the files that have changed).')
+    group_optional.add_argument(
+        '--stdout', action='store_true', dest='stdout',
+        help='Set this option to direct comparison result into sys.stdout. '
+             '(Default: file)')
+    group_optional.add_argument(
+        '--show-all', action='store_true', dest='show_all',
+        help='Show all the objects in comparison result, including the ones '
+             'that haven\'t changed in code size. (Default: False)')
+    group_optional.add_argument(
+        '--verbose', action='store_true', dest='verbose',
+        help='Show logs in detail for code size measurement. '
+             '(Default: False)')
+    comp_args = parser.parse_args()
+
+    logger = logging.getLogger()
+    logging_util.configure_logger(logger, split_level=logging.NOTSET)
+    logger.setLevel(logging.DEBUG if comp_args.verbose else logging.INFO)
+
+    if os.path.isfile(comp_args.record_dir):
+        logger.error("record directory: {} is not a directory"
+                     .format(comp_args.record_dir))
+        sys.exit(1)
+    if os.path.isfile(comp_args.comp_dir):
+        logger.error("comparison directory: {} is not a directory"
+                     .format(comp_args.comp_dir))
+        sys.exit(1)
+
+    comp_args.old_rev = CodeSizeCalculator.validate_git_revision(
+        comp_args.old_rev)
+    if comp_args.new_rev != 'current':
+        comp_args.new_rev = CodeSizeCalculator.validate_git_revision(
+            comp_args.new_rev)
+
+    # version, git_rev, arch, config, compiler, opt_level
+    old_size_dist_info = CodeSizeDistinctInfo(
+        'old', comp_args.old_rev, comp_args.arch, comp_args.config, 'cc', '-Os')
+    new_size_dist_info = CodeSizeDistinctInfo(
+        'new', comp_args.new_rev, comp_args.arch, comp_args.config, 'cc', '-Os')
+    # host_arch, measure_cmd
+    size_common_info = CodeSizeCommonInfo(
+        detect_arch(), 'size -t')
+    # record_dir, comp_dir, with_markdown, stdout, show_all
+    result_options = CodeSizeResultInfo(
+        comp_args.record_dir, comp_args.comp_dir,
+        comp_args.markdown, comp_args.stdout, comp_args.show_all)
+
+    logger.info("Measure code size between {} and {} by `{}`."
+                .format(old_size_dist_info.get_info_indication(),
+                        new_size_dist_info.get_info_indication(),
+                        size_common_info.get_info_indication()))
+    CodeSizeComparison(old_size_dist_info, new_size_dist_info,
+                       size_common_info, result_options,
+                       logger).get_comparision_results()
+
+if __name__ == "__main__":
+    main()

vendor/mbedtls/scripts/common.make

@@ -0,0 +1,140 @@
+# To compile on SunOS: add "-lsocket -lnsl" to LDFLAGS
+
+ifndef MBEDTLS_PATH
+MBEDTLS_PATH := ..
+endif
+
+ifeq (,$(wildcard $(MBEDTLS_PATH)/framework/exported.make))
+    # Use the define keyword to get a multi-line message.
+    # GNU make appends ".  Stop.", so tweak the ending of our message accordingly.
+    define error_message
+$(MBEDTLS_PATH)/framework/exported.make not found.
+Run `git submodule update --init` to fetch the submodule contents.
+This is a fatal error
+    endef
+    $(error $(error_message))
+endif
+include $(MBEDTLS_PATH)/framework/exported.make
+
+CFLAGS	?= -O2
+WARNING_CFLAGS ?= -Wall -Wextra -Wformat=2 -Wno-format-nonliteral
+WARNING_CXXFLAGS ?= -Wall -Wextra -Wformat=2 -Wno-format-nonliteral -std=c++11 -pedantic
+LDFLAGS ?=
+
+LOCAL_CFLAGS = $(WARNING_CFLAGS) -I$(MBEDTLS_TEST_PATH)/include \
+               -I$(MBEDTLS_PATH)/framework/tests/include \
+               -I$(MBEDTLS_PATH)/include \
+               -D_FILE_OFFSET_BITS=64
+LOCAL_CXXFLAGS = $(WARNING_CXXFLAGS) $(LOCAL_CFLAGS)
+
+LOCAL_LDFLAGS = ${MBEDTLS_TEST_OBJS} 		\
+		-L$(MBEDTLS_PATH)/library			\
+		-lmbedtls$(SHARED_SUFFIX)	\
+		-lmbedx509$(SHARED_SUFFIX)	\
+		-lmbedcrypto$(SHARED_SUFFIX)
+
+include $(MBEDTLS_PATH)/3rdparty/Makefile.inc
+LOCAL_CFLAGS+=$(THIRDPARTY_INCLUDES)
+
+ifndef SHARED
+MBEDLIBS=$(MBEDTLS_PATH)/library/libmbedcrypto.a $(MBEDTLS_PATH)/library/libmbedx509.a $(MBEDTLS_PATH)/library/libmbedtls.a
+else
+MBEDLIBS=$(MBEDTLS_PATH)/library/libmbedcrypto.$(DLEXT) $(MBEDTLS_PATH)/library/libmbedx509.$(DLEXT) $(MBEDTLS_PATH)/library/libmbedtls.$(DLEXT)
+endif
+
+ifdef DEBUG
+LOCAL_CFLAGS += -g3
+endif
+
+# if we're running on Windows, build for Windows
+ifdef WINDOWS
+WINDOWS_BUILD=1
+endif
+
+## Usage: $(call remove_enabled_options,PREPROCESSOR_INPUT)
+## Remove the preprocessor symbols that are set in the current configuration
+## from PREPROCESSOR_INPUT. Also normalize whitespace.
+## Example:
+##   $(call remove_enabled_options,MBEDTLS_FOO MBEDTLS_BAR)
+## This expands to an empty string "" if MBEDTLS_FOO and MBEDTLS_BAR are both
+## enabled, to "MBEDTLS_FOO" if MBEDTLS_BAR is enabled but MBEDTLS_FOO is
+## disabled, etc.
+##
+## This only works with a Unix-like shell environment (Bourne/POSIX-style shell
+## and standard commands) and a Unix-like compiler (supporting -E). In
+## other environments, the output is likely to be empty.
+define remove_enabled_options
+$(strip $(shell
+  exec 2>/dev/null;
+  { echo '#include <mbedtls/build_info.h>'; echo $(1); } |
+  $(CC) $(LOCAL_CFLAGS) $(CFLAGS) -E - |
+  tail -n 1
+))
+endef
+
+ifdef WINDOWS_BUILD
+  DLEXT=dll
+  EXEXT=.exe
+  LOCAL_LDFLAGS += -lws2_32 -lbcrypt
+  ifdef SHARED
+    SHARED_SUFFIX=.$(DLEXT)
+  endif
+
+else # Not building for Windows
+  DLEXT ?= so
+  EXEXT=
+  SHARED_SUFFIX=
+  ifndef THREADING
+    # Auto-detect configurations with pthread.
+    # If the call to remove_enabled_options returns "control", the symbols
+    # are confirmed set and we link with pthread.
+    # If the auto-detection fails, the result of the call is empty and
+    # we keep THREADING undefined.
+    ifeq (control,$(call remove_enabled_options,control MBEDTLS_THREADING_C MBEDTLS_THREADING_PTHREAD))
+      THREADING := pthread
+    endif
+  endif
+
+  ifeq ($(THREADING),pthread)
+    LOCAL_LDFLAGS += -lpthread
+  endif
+endif
+
+ifdef WINDOWS
+PYTHON ?= python
+else
+PYTHON ?= $(shell if type python3 >/dev/null 2>/dev/null; then echo python3; else echo python; fi)
+endif
+
+# See root Makefile
+GEN_FILES ?= yes
+ifdef GEN_FILES
+gen_file_dep =
+else
+gen_file_dep = |
+endif
+
+default: all
+
+$(MBEDLIBS):
+	$(MAKE) -C $(MBEDTLS_PATH)/library $(@F)
+
+neat: clean
+ifndef WINDOWS
+	rm -f $(GENERATED_FILES)
+else
+	for %f in ($(subst /,\,$(GENERATED_FILES))) if exist %f del /Q /F %f
+endif
+
+# Auxiliary modules used by tests and some sample programs
+MBEDTLS_CORE_TEST_OBJS := $(patsubst %.c,%.o,$(wildcard \
+    ${MBEDTLS_PATH}/framework/tests/src/*.c \
+    ${MBEDTLS_PATH}/framework/tests/src/drivers/*.c \
+  ))
+# Additional auxiliary modules for TLS testing
+MBEDTLS_TLS_TEST_OBJS = $(patsubst %.c,%.o,$(wildcard \
+    ${MBEDTLS_TEST_PATH}/src/*.c \
+    ${MBEDTLS_TEST_PATH}/src/test_helpers/*.c \
+  ))
+
+MBEDTLS_TEST_OBJS = $(MBEDTLS_CORE_TEST_OBJS) $(MBEDTLS_TLS_TEST_OBJS)

vendor/mbedtls/scripts/config.pl

@@ -0,0 +1,14 @@
+#!/usr/bin/env perl
+# Backward compatibility redirection
+
+## Copyright The Mbed TLS Contributors
+## SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+##
+
+my $py = $0;
+$py =~ s/\.pl$/.py/ or die "Unable to determine the name of the Python script";
+exec 'python3', $py, @ARGV;
+print STDERR "$0: python3: $!. Trying python instead.\n";
+exec 'python', $py, @ARGV;
+print STDERR "$0: python: $!\n";
+exit 127;

vendor/mbedtls/scripts/config.py

@@ -0,0 +1,413 @@
+#!/usr/bin/env python3
+
+"""Mbed TLS and PSA configuration file manipulation library and tool
+
+Basic usage, to read the Mbed TLS configuration:
+    config = MbedTLSConfig()
+    if 'MBEDTLS_RSA_C' in config: print('RSA is enabled')
+"""
+
+## Copyright The Mbed TLS Contributors
+## SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+##
+
+import os
+import sys
+
+import framework_scripts_path # pylint: disable=unused-import
+from mbedtls_framework import config_common
+
+
+def is_boolean_setting(name, value):
+    """Is this a boolean setting?
+
+    Mbed TLS boolean settings are enabled if the preprocessor macro is
+    defined, and disabled if the preprocessor macro is not defined. The
+    macro definition line in the configuration file has an empty expansion.
+
+    PSA_WANT_xxx settings are also boolean, but when they are enabled,
+    they expand to a nonzero value. We leave them undefined when they
+    are disabled. (Setting them to 0 currently means to enable them, but
+    this might change to mean disabling them. Currently we just never set
+    them to 0.)
+    """
+    if name.startswith('PSA_WANT_'):
+        return True
+    if not value:
+        return True
+    return False
+
+def realfull_adapter(_name, _value, _active):
+    """Activate all symbols.
+
+    This is intended for building the documentation, including the
+    documentation of settings that are activated by defining an optional
+    preprocessor macro. There is no expectation that the resulting
+    configuration can be built.
+    """
+    return True
+
+PSA_UNSUPPORTED_FEATURE = frozenset([
+    'PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE',
+    'PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE'
+])
+
+PSA_DEPRECATED_FEATURE = frozenset([
+    'PSA_WANT_KEY_TYPE_ECC_KEY_PAIR',
+    'PSA_WANT_KEY_TYPE_RSA_KEY_PAIR'
+])
+
+EXCLUDE_FROM_CRYPTO = PSA_UNSUPPORTED_FEATURE | \
+                      PSA_DEPRECATED_FEATURE
+
+# The goal of the full configuration is to have everything that can be tested
+# together. This includes deprecated or insecure options. It excludes:
+# * Options that require additional build dependencies or unusual hardware.
+# * Options that make testing less effective.
+# * Options that are incompatible with other options, or more generally that
+#   interact with other parts of the code in such a way that a bulk enabling
+#   is not a good way to test them.
+# * Options that remove features.
+EXCLUDE_FROM_FULL = frozenset([
+    #pylint: disable=line-too-long
+    'MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH', # interacts with CTR_DRBG_128_BIT_KEY
+    'MBEDTLS_AES_USE_HARDWARE_ONLY', # hardware dependency
+    'MBEDTLS_BLOCK_CIPHER_NO_DECRYPT', # incompatible with ECB in PSA, CBC/XTS/NIST_KW/DES
+    'MBEDTLS_CTR_DRBG_USE_128_BIT_KEY', # interacts with ENTROPY_FORCE_SHA256
+    'MBEDTLS_DEPRECATED_REMOVED', # conflicts with deprecated options
+    'MBEDTLS_DEPRECATED_WARNING', # conflicts with deprecated options
+    'MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED', # influences the use of ECDH in TLS
+    'MBEDTLS_ECP_NO_FALLBACK', # removes internal ECP implementation
+    'MBEDTLS_ECP_WITH_MPI_UINT', # disables the default ECP and is experimental
+    'MBEDTLS_ENTROPY_FORCE_SHA256', # interacts with CTR_DRBG_128_BIT_KEY
+    'MBEDTLS_HAVE_SSE2', # hardware dependency
+    'MBEDTLS_MEMORY_BACKTRACE', # depends on MEMORY_BUFFER_ALLOC_C
+    'MBEDTLS_MEMORY_BUFFER_ALLOC_C', # makes sanitizers (e.g. ASan) less effective
+    'MBEDTLS_MEMORY_DEBUG', # depends on MEMORY_BUFFER_ALLOC_C
+    'MBEDTLS_NO_64BIT_MULTIPLICATION', # influences anything that uses bignum
+    'MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES', # removes a feature
+    'MBEDTLS_NO_PLATFORM_ENTROPY', # removes a feature
+    'MBEDTLS_NO_UDBL_DIVISION', # influences anything that uses bignum
+    'MBEDTLS_PSA_P256M_DRIVER_ENABLED', # influences SECP256R1 KeyGen/ECDH/ECDSA
+    'MBEDTLS_PLATFORM_NO_STD_FUNCTIONS', # removes a feature
+    'MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS', # removes a feature
+    'MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG', # behavior change + build dependency
+    'MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER', # interface and behavior change
+    'MBEDTLS_PSA_CRYPTO_SPM', # platform dependency (PSA SPM)
+    'MBEDTLS_PSA_INJECT_ENTROPY', # conflicts with platform entropy sources
+    'MBEDTLS_RSA_NO_CRT', # influences the use of RSA in X.509 and TLS
+    'MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY', # interacts with *_USE_A64_CRYPTO_IF_PRESENT
+    'MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY', # interacts with *_USE_ARMV8_A_CRYPTO_IF_PRESENT
+    'MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY', # interacts with *_USE_A64_CRYPTO_IF_PRESENT
+    'MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT', # setting *_USE_ARMV8_A_CRYPTO is sufficient
+    'MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN', # build dependency (clang+memsan)
+    'MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND', # build dependency (valgrind headers)
+    'MBEDTLS_X509_REMOVE_INFO', # removes a feature
+    'MBEDTLS_PSA_STATIC_KEY_SLOTS', # only relevant for embedded devices
+    'MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE', # only relevant for embedded devices
+])
+
+def is_seamless_alt(name):
+    """Whether the xxx_ALT symbol should be included in the full configuration.
+
+    Include alternative implementations of platform functions, which are
+    configurable function pointers that default to the built-in function.
+    This way we test that the function pointers exist and build correctly
+    without changing the behavior, and tests can verify that the function
+    pointers are used by modifying those pointers.
+
+    Exclude alternative implementations of library functions since they require
+    an implementation of the relevant functions and an xxx_alt.h header.
+    """
+    if name in (
+            'MBEDTLS_PLATFORM_GMTIME_R_ALT',
+            'MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT',
+            'MBEDTLS_PLATFORM_MS_TIME_ALT',
+            'MBEDTLS_PLATFORM_ZEROIZE_ALT',
+    ):
+        # Similar to non-platform xxx_ALT, requires platform_alt.h
+        return False
+    return name.startswith('MBEDTLS_PLATFORM_')
+
+def include_in_full(name):
+    """Rules for symbols in the "full" configuration."""
+    if name in EXCLUDE_FROM_FULL:
+        return False
+    if name.endswith('_ALT'):
+        return is_seamless_alt(name)
+    return True
+
+def full_adapter(name, value, active):
+    """Config adapter for "full"."""
+    if not is_boolean_setting(name, value):
+        return active
+    return include_in_full(name)
+
+# The baremetal configuration excludes options that require a library or
+# operating system feature that is typically not present on bare metal
+# systems. Features that are excluded from "full" won't be in "baremetal"
+# either (unless explicitly turned on in baremetal_adapter) so they don't
+# need to be repeated here.
+EXCLUDE_FROM_BAREMETAL = frozenset([
+    #pylint: disable=line-too-long
+    'MBEDTLS_ENTROPY_NV_SEED', # requires a filesystem and FS_IO or alternate NV seed hooks
+    'MBEDTLS_FS_IO', # requires a filesystem
+    'MBEDTLS_HAVE_TIME', # requires a clock
+    'MBEDTLS_HAVE_TIME_DATE', # requires a clock
+    'MBEDTLS_NET_C', # requires POSIX-like networking
+    'MBEDTLS_PLATFORM_FPRINTF_ALT', # requires FILE* from stdio.h
+    'MBEDTLS_PLATFORM_NV_SEED_ALT', # requires a filesystem and ENTROPY_NV_SEED
+    'MBEDTLS_PLATFORM_TIME_ALT', # requires a clock and HAVE_TIME
+    'MBEDTLS_PSA_CRYPTO_SE_C', # requires a filesystem and PSA_CRYPTO_STORAGE_C
+    'MBEDTLS_PSA_CRYPTO_STORAGE_C', # requires a filesystem
+    'MBEDTLS_PSA_ITS_FILE_C', # requires a filesystem
+    'MBEDTLS_THREADING_C', # requires a threading interface
+    'MBEDTLS_THREADING_PTHREAD', # requires pthread
+    'MBEDTLS_TIMING_C', # requires a clock
+    'MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT', # requires an OS for runtime-detection
+    'MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT', # requires an OS for runtime-detection
+    'MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT', # requires an OS for runtime-detection
+])
+
+def keep_in_baremetal(name):
+    """Rules for symbols in the "baremetal" configuration."""
+    if name in EXCLUDE_FROM_BAREMETAL:
+        return False
+    return True
+
+def baremetal_adapter(name, value, active):
+    """Config adapter for "baremetal"."""
+    if not is_boolean_setting(name, value):
+        return active
+    if name == 'MBEDTLS_NO_PLATFORM_ENTROPY':
+        # No OS-provided entropy source
+        return True
+    return include_in_full(name) and keep_in_baremetal(name)
+
+# This set contains options that are mostly for debugging or test purposes,
+# and therefore should be excluded when doing code size measurements.
+# Options that are their own module (such as MBEDTLS_ERROR_C) are not listed
+# and therefore will be included when doing code size measurements.
+EXCLUDE_FOR_SIZE = frozenset([
+    'MBEDTLS_DEBUG_C', # large code size increase in TLS
+    'MBEDTLS_SELF_TEST', # increases the size of many modules
+    'MBEDTLS_TEST_HOOKS', # only useful with the hosted test framework, increases code size
+])
+
+def baremetal_size_adapter(name, value, active):
+    if name in EXCLUDE_FOR_SIZE:
+        return False
+    return baremetal_adapter(name, value, active)
+
+def include_in_crypto(name):
+    """Rules for symbols in a crypto configuration."""
+    if name.startswith('MBEDTLS_X509_') or \
+       name.startswith('MBEDTLS_SSL_') or \
+       name.startswith('MBEDTLS_KEY_EXCHANGE_'):
+        return False
+    if name in [
+            'MBEDTLS_DEBUG_C', # part of libmbedtls
+            'MBEDTLS_NET_C', # part of libmbedtls
+            'MBEDTLS_PKCS7_C', # part of libmbedx509
+    ]:
+        return False
+    return True
+
+def crypto_adapter(adapter):
+    """Modify an adapter to disable non-crypto symbols.
+
+    ``crypto_adapter(adapter)(name, value, active)`` is like
+    ``adapter(name, value, active)``, but unsets all X.509 and TLS symbols.
+    """
+    def continuation(name, value, active):
+        if not include_in_crypto(name):
+            return False
+        if adapter is None:
+            return active
+        return adapter(name, value, active)
+    return continuation
+
+DEPRECATED = frozenset([
+    'MBEDTLS_PSA_CRYPTO_SE_C',
+    'MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME',
+])
+def no_deprecated_adapter(adapter):
+    """Modify an adapter to disable deprecated symbols.
+
+    ``no_deprecated_adapter(adapter)(name, value, active)`` is like
+    ``adapter(name, value, active)``, but unsets all deprecated symbols
+    and sets ``MBEDTLS_DEPRECATED_REMOVED``.
+    """
+    def continuation(name, value, active):
+        if name == 'MBEDTLS_DEPRECATED_REMOVED':
+            return True
+        if name in DEPRECATED:
+            return False
+        if adapter is None:
+            return active
+        return adapter(name, value, active)
+    return continuation
+
+def no_platform_adapter(adapter):
+    """Modify an adapter to disable platform symbols.
+
+    ``no_platform_adapter(adapter)(name, value, active)`` is like
+    ``adapter(name, value, active)``, but unsets all platform symbols other
+    ``than MBEDTLS_PLATFORM_C.
+    """
+    def continuation(name, value, active):
+        # Allow MBEDTLS_PLATFORM_C but remove all other platform symbols.
+        if name.startswith('MBEDTLS_PLATFORM_') and name != 'MBEDTLS_PLATFORM_C':
+            return False
+        if adapter is None:
+            return active
+        return adapter(name, value, active)
+    return continuation
+
+
+class MbedTLSConfigFile(config_common.ConfigFile):
+    """Representation of an MbedTLS configuration file."""
+
+    _path_in_tree = 'include/mbedtls/mbedtls_config.h'
+    default_path = [_path_in_tree,
+                    os.path.join(os.path.dirname(__file__),
+                                 os.pardir,
+                                 _path_in_tree),
+                    os.path.join(os.path.dirname(os.path.abspath(os.path.dirname(__file__))),
+                                 _path_in_tree)]
+
+    def __init__(self, filename=None):
+        super().__init__(self.default_path, 'Mbed TLS', filename)
+        self.current_section = 'header'
+
+
+class CryptoConfigFile(config_common.ConfigFile):
+    """Representation of a Crypto configuration file."""
+
+    # Temporary, while Mbed TLS does not just rely on the TF-PSA-Crypto
+    # build system to build its crypto library. When it does, the
+    # condition can just be removed.
+    _path_in_tree = 'include/psa/crypto_config.h'
+    default_path = [_path_in_tree,
+                    os.path.join(os.path.dirname(__file__),
+                                 os.pardir,
+                                 _path_in_tree),
+                    os.path.join(os.path.dirname(os.path.abspath(os.path.dirname(__file__))),
+                                 _path_in_tree)]
+
+    def __init__(self, filename=None):
+        super().__init__(self.default_path, 'Crypto', filename)
+
+
+class MbedTLSConfig(config_common.Config):
+    """Representation of the Mbed TLS configuration.
+
+    See the documentation of the `Config` class for methods to query
+    and modify the configuration.
+    """
+
+    def __init__(self, filename=None):
+        """Read the Mbed TLS configuration file."""
+
+        super().__init__()
+        configfile = MbedTLSConfigFile(filename)
+        self.configfiles.append(configfile)
+        self.settings.update({name: config_common.Setting(configfile, active, name, value, section)
+                              for (active, name, value, section)
+                              in configfile.parse_file()})
+
+    def set(self, name, value=None):
+        """Set name to the given value and make it active."""
+
+        if name not in self.settings:
+            self._get_configfile().templates.append((name, '', '#define ' + name + ' '))
+
+        super().set(name, value)
+
+
+class CryptoConfig(config_common.Config):
+    """Representation of the PSA crypto configuration.
+
+    See the documentation of the `Config` class for methods to query
+    and modify the configuration.
+    """
+
+    def __init__(self, filename=None):
+        """Read the PSA crypto configuration file."""
+
+        super().__init__()
+        configfile = CryptoConfigFile(filename)
+        self.configfiles.append(configfile)
+        self.settings.update({name: config_common.Setting(configfile, active, name, value, section)
+                              for (active, name, value, section)
+                              in configfile.parse_file()})
+
+    def set(self, name, value='1'):
+        """Set name to the given value and make it active."""
+
+        if name in PSA_UNSUPPORTED_FEATURE:
+            raise ValueError(f'Feature is unsupported: \'{name}\'')
+
+        if name not in self.settings:
+            self._get_configfile().templates.append((name, '', '#define ' + name + ' '))
+
+        super().set(name, value)
+
+
+class MbedTLSConfigTool(config_common.ConfigTool):
+    """Command line mbedtls_config.h and crypto_config.h manipulation tool."""
+
+    def __init__(self):
+        super().__init__(MbedTLSConfigFile.default_path)
+        self.config = MbedTLSConfig(self.args.file)
+
+    def custom_parser_options(self):
+        """Adds MbedTLS specific options for the parser."""
+
+        self.parser.add_argument(
+            '--cryptofile', '-c',
+            help="""Crypto file to read (and modify if requested). Default: {}."""
+            .format(CryptoConfigFile.default_path))
+
+        self.add_adapter(
+            'baremetal', baremetal_adapter,
+            """Like full, but exclude features that require platform features
+            such as file input-output.
+            """)
+        self.add_adapter(
+            'baremetal_size', baremetal_size_adapter,
+            """Like baremetal, but exclude debugging features. Useful for code size measurements.
+            """)
+        self.add_adapter(
+            'full', full_adapter,
+            """Uncomment most features.
+            Exclude alternative implementations and platform support options, as well as
+            some options that are awkward to test.
+            """)
+        self.add_adapter(
+            'full_no_deprecated', no_deprecated_adapter(full_adapter),
+            """Uncomment most non-deprecated features.
+            Like "full", but without deprecated features.
+            """)
+        self.add_adapter(
+            'full_no_platform', no_platform_adapter(full_adapter),
+            """Uncomment most non-platform features. Like "full", but without platform features.
+            """)
+        self.add_adapter(
+            'realfull', realfull_adapter,
+            """Uncomment all boolean #defines.
+            Suitable for generating documentation, but not for building.
+            """)
+        self.add_adapter(
+            'crypto', crypto_adapter(None),
+            """Only include crypto features. Exclude X.509 and TLS.""")
+        self.add_adapter(
+            'crypto_baremetal', crypto_adapter(baremetal_adapter),
+            """Like baremetal, but with only crypto features, excluding X.509 and TLS.""")
+        self.add_adapter(
+            'crypto_full', crypto_adapter(full_adapter),
+            """Like full, but with only crypto features, excluding X.509 and TLS.""")
+
+
+if __name__ == '__main__':
+    sys.exit(MbedTLSConfigTool().main())

vendor/mbedtls/scripts/data_files/driver_jsons/driver_opaque_schema.json

@@ -0,0 +1,71 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "type": "object",
+  "properties": {
+    "_comment": {
+      "type": "string"
+    },
+    "prefix": {
+      "type": "string",
+      "pattern": "^[A-Z_a-z][0-9A-Z_a-z]*$"
+    },
+    "type": {
+      "type": "string",
+      "const": "opaque"
+    },
+    "location": {
+      "type": ["integer","string"],
+      "pattern": "^(0x|0X)?[a-fA-F0-9]+$"
+    },
+    "mbedtls/h_condition": {
+      "type": "string"
+    },
+    "headers": {
+      "type": "array",
+      "items": {
+          "type": "string"
+        },
+        "default": []
+    },
+    "capabilities": {
+      "type": "array",
+      "items": [
+        {
+          "type": "object",
+          "properties": {
+            "_comment": {
+              "type": "string"
+            },
+            "mbedtls/c_condition": {
+              "type": "string"
+            },
+            "entry_points": {
+              "type": "array",
+              "items": {
+                  "type": "string"
+                }
+            },
+            "names": {
+              "type": "object",
+              "patternProperties": {
+                "^[A-Z_a-z][0-9A-Z_a-z]*$": {
+                  "type": "string",
+                  "pattern": "^[A-Z_a-z][0-9A-Z_a-z]*$"
+                }
+              }
+            }
+          },
+          "required": [
+            "entry_points"
+          ]
+        }
+      ]
+    }
+  },
+  "required": [
+    "prefix",
+    "type",
+    "location",
+    "capabilities"
+  ]
+}

vendor/mbedtls/scripts/data_files/driver_jsons/driver_transparent_schema.json

@@ -0,0 +1,70 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "type": "object",
+  "properties": {
+    "_comment": {
+      "type": "string"
+    },
+    "prefix": {
+      "type": "string",
+      "pattern": "^[A-Z_a-z][0-9A-Z_a-z]*$"
+    },
+    "type": {
+      "type": "string",
+      "const": "transparent"
+    },
+    "mbedtls/h_condition": {
+      "type": "string"
+    },
+    "headers": {
+      "type": "array",
+      "items": {
+          "type": "string"
+        },
+        "default": []
+    },
+    "capabilities": {
+      "type": "array",
+      "items": [
+        {
+          "type": "object",
+          "properties": {
+            "_comment": {
+              "type": "string"
+            },
+            "mbedtls/c_condition": {
+              "type": "string"
+            },
+            "entry_points": {
+              "type": "array",
+              "items": {
+                  "type": "string"
+                }
+            },
+            "names": {
+              "type": "object",
+              "patternProperties": {
+                "^[A-Z_a-z][0-9A-Z_a-z]*$": {
+                  "type": "string",
+                  "pattern": "^[A-Z_a-z][0-9A-Z_a-z]*$"
+                }
+              }
+            },
+            "fallback": {
+              "type": "boolean",
+              "default": "false"
+            }
+          },
+          "required": [
+            "entry_points"
+          ]
+        }
+      ]
+    }
+  },
+  "required": [
+    "prefix",
+    "type",
+    "capabilities"
+  ]
+}

vendor/mbedtls/scripts/data_files/driver_jsons/driverlist.json

@@ -0,0 +1 @@
+["mbedtls_test_opaque_driver.json","mbedtls_test_transparent_driver.json","p256_transparent_driver.json"]

vendor/mbedtls/scripts/data_files/driver_jsons/mbedtls_test_opaque_driver.json

@@ -0,0 +1,20 @@
+{
+    "prefix":       "mbedtls_test",
+    "type":         "opaque",
+    "location":     "0x7fffff",
+    "mbedtls/h_condition":   "defined(PSA_CRYPTO_DRIVER_TEST)",
+    "headers":      ["test/drivers/test_driver.h"],
+    "capabilities": [
+        {
+            "_comment":     "The Mbed TLS opaque driver supports import key/export key/export_public key",
+            "mbedtls/c_condition":    "defined(PSA_CRYPTO_DRIVER_TEST)",
+            "entry_points": ["import_key", "export_key", "export_public_key"]
+        },
+        {
+            "_comment":     "The Mbed TLS opaque driver supports copy key/ get builtin key",
+            "mbedtls/c_condition":    "defined(PSA_CRYPTO_DRIVER_TEST)",
+            "entry_points": ["copy_key", "get_builtin_key"],
+            "names":         {"copy_key":"mbedtls_test_opaque_copy_key", "get_builtin_key":"mbedtls_test_opaque_get_builtin_key"}
+        }
+     ]
+}

vendor/mbedtls/scripts/data_files/driver_jsons/mbedtls_test_transparent_driver.json

@@ -0,0 +1,22 @@
+{
+    "prefix":       "mbedtls_test",
+    "type":         "transparent",
+    "mbedtls/h_condition":   "defined(PSA_CRYPTO_DRIVER_TEST)",
+    "headers":      ["test/drivers/test_driver.h"],
+    "capabilities": [
+        {
+            "_comment":     "The Mbed TLS transparent driver supports import key/export key",
+            "mbedtls/c_condition":    "defined(PSA_CRYPTO_DRIVER_TEST)",
+            "entry_points": ["import_key"],
+            "fallback":     true
+        },
+        {
+            "_comment":     "The Mbed TLS transparent driver supports export_public key",
+            "mbedtls/c_condition":    "defined(PSA_CRYPTO_DRIVER_TEST)",
+            "entry_points": ["export_public_key"],
+            "fallback":     true,
+            "names":         {"export_public_key":"mbedtls_test_transparent_export_public_key"}
+        }
+
+    ]
+}

vendor/mbedtls/scripts/data_files/driver_jsons/p256_transparent_driver.json

@@ -0,0 +1,20 @@
+{
+    "prefix":       "p256",
+    "type":         "transparent",
+    "mbedtls/h_condition":   "defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED)",
+    "headers":      ["../3rdparty/p256-m/p256-m_driver_entrypoints.h"],
+    "capabilities": [
+        {
+            "mbedtls/c_condition": "defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED)",
+            "_comment_entry_points": "This is not the complete list of entry points supported by this driver, only those that are currently supported in JSON. See docs/psa-driver-example-and-guide.md",
+            "entry_points": ["import_key", "export_public_key"],
+            "algorithms": ["PSA_ALG_ECDH", "PSA_ALG_ECDSA(PSA_ALG_ANY_HASH)"],
+            "key_types": [
+                "PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1)",
+                "PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_SECP_R1)"
+            ],
+            "key_sizes": [256],
+            "fallback": false
+        }
+    ]
+}

vendor/mbedtls/scripts/data_files/driver_templates/OS-template-opaque.jinja

@@ -0,0 +1,17 @@
+{# One Shot function's dispatch code for opaque drivers.
+Expected inputs:
+* drivers: the list of driver descriptions.
+* entry_point: the name of the entry point that this function dispatches to.
+* entry_point_param(driver): the parameters to pass to the entry point.
+* nest_indent: number of extra spaces to indent the code to.
+-#}
+{% for driver in drivers if driver.type == "opaque" -%}
+{% for capability in driver.capabilities if entry_point in capability.entry_points -%}
+#if ({% if capability['mbedtls/c_condition'] is defined -%}{{ capability['mbedtls/c_condition'] }} {% else -%} {{ 1 }} {% endif %})
+{%- filter indent(width = nest_indent) %}
+case {{ driver.location }}:
+    return( {{ entry_point_name(capability, entry_point, driver) }}({{entry_point_param(driver) | indent(20)}}));
+{% endfilter -%}
+#endif
+{% endfor %}
+{% endfor %}

vendor/mbedtls/scripts/data_files/driver_templates/OS-template-transparent.jinja

@@ -0,0 +1,19 @@
+{# One Shot function's dispatch code for transparent drivers.
+Expected inputs:
+* drivers: the list of driver descriptions.
+* entry_point: the name of the entry point that this function dispatches to.
+* entry_point_param(driver): the parameters to pass to the entry point.
+* nest_indent: number of extra spaces to indent the code to.
+-#}
+{% for driver in drivers if driver.type == "transparent" -%}
+{% for capability in driver.capabilities if entry_point in capability.entry_points -%}
+#if ({% if capability['mbedtls/c_condition'] is defined -%}{{ capability['mbedtls/c_condition'] }} {% else -%} {{ 1 }} {% endif %})
+{%- filter indent(width = nest_indent) %}
+status = {{ entry_point_name(capability, entry_point, driver) }}({{entry_point_param(driver) | indent(20)}});
+
+if( status != PSA_ERROR_NOT_SUPPORTED )
+    return( status );
+{% endfilter -%}
+#endif
+{% endfor %}
+{% endfor %}

vendor/mbedtls/scripts/data_files/driver_templates/psa_crypto_driver_wrappers_no_static.c.jinja

@@ -0,0 +1,224 @@
+/*
+ *  Functions to delegate cryptographic operations to an available
+ *  and appropriate accelerator.
+ *  Warning: This file is now auto-generated.
+ */
+/*  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ */
+
+
+/* BEGIN-common headers */
+#include "common.h"
+#include "psa_crypto_aead.h"
+#include "psa_crypto_cipher.h"
+#include "psa_crypto_core.h"
+#include "psa_crypto_driver_wrappers_no_static.h"
+#include "psa_crypto_hash.h"
+#include "psa_crypto_mac.h"
+#include "psa_crypto_pake.h"
+#include "psa_crypto_rsa.h"
+
+#include "mbedtls/platform.h"
+/* END-common headers */
+
+#if defined(MBEDTLS_PSA_CRYPTO_C)
+
+/* BEGIN-driver headers */
+{% for driver in drivers -%}
+/* Headers for {{driver.prefix}} {{driver.type}} driver */
+{% if driver['mbedtls/h_condition'] is defined -%}
+#if {{ driver['mbedtls/h_condition'] }}
+{% endif -%}
+{% for header in driver.headers -%}
+#include "{{ header }}"
+{% endfor %}
+{% if driver['mbedtls/h_condition'] is defined -%}
+#endif
+{% endif -%}
+{% endfor %}
+/* END-driver headers */
+
+/* Auto-generated values depending on which drivers are registered.
+ * ID 0 is reserved for unallocated operations.
+ * ID 1 is reserved for the Mbed TLS software driver. */
+/* BEGIN-driver id definition */
+#define PSA_CRYPTO_MBED_TLS_DRIVER_ID (1)
+{% for driver in drivers -%}
+#define {{(driver.prefix + "_" + driver.type + "_driver_id").upper()}} ({{ loop.index + 1 }})
+{% endfor %}
+/* END-driver id */
+
+/* BEGIN-Common Macro definitions */
+{% macro entry_point_name(capability, entry_point, driver) -%}
+    {% if capability.name is defined and entry_point in capability.names.keys() -%}
+    {{ capability.names[entry_point]}}
+    {% else -%}
+    {{driver.prefix}}_{{driver.type}}_{{entry_point}}
+    {% endif -%}
+{% endmacro %}
+/* END-Common Macro definitions */
+
+/* Support the 'old' SE interface when asked to */
+#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
+/* PSA_CRYPTO_DRIVER_PRESENT is defined when either a new-style or old-style
+ * SE driver is present, to avoid unused argument errors at compile time. */
+#ifndef PSA_CRYPTO_DRIVER_PRESENT
+#define PSA_CRYPTO_DRIVER_PRESENT
+#endif
+#include "psa_crypto_se.h"
+#endif
+
+/** Get the key buffer size required to store the key material of a key
+ *  associated with an opaque driver.
+ *
+ * \param[in] attributes  The key attributes.
+ * \param[out] key_buffer_size  Minimum buffer size to contain the key material
+ *
+ * \retval #PSA_SUCCESS
+ *         The minimum size for a buffer to contain the key material has been
+ *         returned successfully.
+ * \retval #PSA_ERROR_NOT_SUPPORTED
+ *         The type and/or the size in bits of the key or the combination of
+ *         the two is not supported.
+ * \retval #PSA_ERROR_INVALID_ARGUMENT
+ *         The key is declared with a lifetime not known to us.
+ */
+psa_status_t psa_driver_wrapper_get_key_buffer_size(
+    const psa_key_attributes_t *attributes,
+    size_t *key_buffer_size )
+{
+    psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) );
+    psa_key_type_t key_type = psa_get_key_type(attributes);
+    size_t key_bits = psa_get_key_bits(attributes);
+
+    *key_buffer_size = 0;
+    switch( location )
+    {
+#if defined(PSA_CRYPTO_DRIVER_TEST)
+        case PSA_CRYPTO_TEST_DRIVER_LOCATION:
+#if defined(MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS)
+            /* Emulate property 'builtin_key_size' */
+            if( psa_key_id_is_builtin(
+                    MBEDTLS_SVC_KEY_ID_GET_KEY_ID(
+                        psa_get_key_id( attributes ) ) ) )
+            {
+                *key_buffer_size = sizeof( psa_drv_slot_number_t );
+                return( PSA_SUCCESS );
+            }
+#endif /* MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS */
+            *key_buffer_size = mbedtls_test_opaque_size_function( key_type,
+                                                                  key_bits );
+            return( ( *key_buffer_size != 0 ) ?
+                    PSA_SUCCESS : PSA_ERROR_NOT_SUPPORTED );
+#endif /* PSA_CRYPTO_DRIVER_TEST */
+
+        default:
+            (void)key_type;
+            (void)key_bits;
+            return( PSA_ERROR_INVALID_ARGUMENT );
+    }
+}
+
+psa_status_t psa_driver_wrapper_export_public_key(
+    const psa_key_attributes_t *attributes,
+    const uint8_t *key_buffer, size_t key_buffer_size,
+    uint8_t *data, size_t data_size, size_t *data_length )
+
+{
+{% with entry_point = "export_public_key" -%}
+{% macro entry_point_param(driver) -%}
+attributes,
+key_buffer,
+key_buffer_size,
+data,
+data_size,
+data_length
+{% endmacro %}
+    psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
+    psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(
+                                      psa_get_key_lifetime( attributes ) );
+
+    /* Try dynamically-registered SE interface first */
+#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
+    const psa_drv_se_t *drv;
+    psa_drv_se_context_t *drv_context;
+
+    if( psa_get_se_driver( psa_get_key_lifetime(attributes), &drv, &drv_context ) )
+    {
+        if( ( drv->key_management == NULL ) ||
+            ( drv->key_management->p_export_public == NULL ) )
+        {
+            return( PSA_ERROR_NOT_SUPPORTED );
+        }
+
+        return( drv->key_management->p_export_public(
+                    drv_context,
+                    *( (psa_key_slot_number_t *)key_buffer ),
+                    data, data_size, data_length ) );
+    }
+#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
+
+    switch( location )
+    {
+        case PSA_KEY_LOCATION_LOCAL_STORAGE:
+            /* Key is stored in the slot in export representation, so
+             * cycle through all known transparent accelerators */
+#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
+{% with nest_indent=12 %}
+{% include "OS-template-transparent.jinja" -%}
+{% endwith -%}
+#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
+            /* Fell through, meaning no accelerator supports this operation */
+            return( psa_export_public_key_internal( attributes,
+                                                    key_buffer,
+                                                    key_buffer_size,
+                                                    data,
+                                                    data_size,
+                                                    data_length ) );
+
+        /* Add cases for opaque driver here */
+#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
+{% with nest_indent=8 %}
+{% include "OS-template-opaque.jinja" -%}
+{% endwith -%}
+#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
+        default:
+            /* Key is declared with a lifetime not known to us */
+            return( status );
+    }
+{% endwith %}
+}
+
+psa_status_t psa_driver_wrapper_get_builtin_key(
+    psa_drv_slot_number_t slot_number,
+    psa_key_attributes_t *attributes,
+    uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length )
+{
+{% with entry_point = "get_builtin_key" -%}
+{% macro entry_point_param(driver) -%}
+slot_number,
+attributes,
+key_buffer,
+key_buffer_size,
+key_buffer_length
+{% endmacro %}
+    psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) );
+    switch( location )
+    {
+#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
+{% with nest_indent=8 %}
+{% include "OS-template-opaque.jinja" -%}
+{% endwith -%}
+#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
+        default:
+            (void) slot_number;
+            (void) key_buffer;
+            (void) key_buffer_size;
+            (void) key_buffer_length;
+            return( PSA_ERROR_DOES_NOT_EXIST );
+    }
+{% endwith %}
+}
+
+#endif /* MBEDTLS_PSA_CRYPTO_C */

vendor/mbedtls/scripts/data_files/error.fmt

@@ -0,0 +1,155 @@
+/*
+ *  Error message information
+ *
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ */
+
+#include "common.h"
+
+#include "mbedtls/error.h"
+
+#if defined(MBEDTLS_ERROR_C) || defined(MBEDTLS_ERROR_STRERROR_DUMMY)
+
+#if defined(MBEDTLS_ERROR_C)
+
+#include "mbedtls/platform.h"
+
+#include <stdio.h>
+#include <string.h>
+
+HEADER_INCLUDED
+
+const char *mbedtls_high_level_strerr(int error_code)
+{
+    int high_level_error_code;
+
+    if (error_code < 0) {
+        error_code = -error_code;
+    }
+
+    /* Extract the high-level part from the error code. */
+    high_level_error_code = error_code & 0xFF80;
+
+    switch (high_level_error_code) {
+    /* Begin Auto-Generated Code. */
+    HIGH_LEVEL_CODE_CHECKS
+        /* End Auto-Generated Code. */
+
+        default:
+            break;
+    }
+
+    return NULL;
+}
+
+const char *mbedtls_low_level_strerr(int error_code)
+{
+    int low_level_error_code;
+
+    if (error_code < 0) {
+        error_code = -error_code;
+    }
+
+    /* Extract the low-level part from the error code. */
+    low_level_error_code = error_code & ~0xFF80;
+
+    switch (low_level_error_code) {
+    /* Begin Auto-Generated Code. */
+    LOW_LEVEL_CODE_CHECKS
+        /* End Auto-Generated Code. */
+
+        default:
+            break;
+    }
+
+    return NULL;
+}
+
+void mbedtls_strerror(int ret, char *buf, size_t buflen)
+{
+    size_t len;
+    int use_ret;
+    const char *high_level_error_description = NULL;
+    const char *low_level_error_description = NULL;
+
+    if (buflen == 0) {
+        return;
+    }
+
+    memset(buf, 0x00, buflen);
+
+    if (ret < 0) {
+        ret = -ret;
+    }
+
+    if (ret & 0xFF80) {
+        use_ret = ret & 0xFF80;
+
+        // Translate high level error code.
+        high_level_error_description = mbedtls_high_level_strerr(ret);
+
+        if (high_level_error_description == NULL) {
+            mbedtls_snprintf(buf, buflen, "UNKNOWN ERROR CODE (%04X)", (unsigned int) use_ret);
+        } else {
+            mbedtls_snprintf(buf, buflen, "%s", high_level_error_description);
+        }
+
+#if defined(MBEDTLS_SSL_TLS_C)
+        // Early return in case of a fatal error - do not try to translate low
+        // level code.
+        if (use_ret == -(MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE)) {
+            return;
+        }
+#endif /* MBEDTLS_SSL_TLS_C */
+    }
+
+    use_ret = ret & ~0xFF80;
+
+    if (use_ret == 0) {
+        return;
+    }
+
+    // If high level code is present, make a concatenation between both
+    // error strings.
+    //
+    len = strlen(buf);
+
+    if (len > 0) {
+        if (buflen - len < 5) {
+            return;
+        }
+
+        mbedtls_snprintf(buf + len, buflen - len, " : ");
+
+        buf += len + 3;
+        buflen -= len + 3;
+    }
+
+    // Translate low level error code.
+    low_level_error_description = mbedtls_low_level_strerr(ret);
+
+    if (low_level_error_description == NULL) {
+        mbedtls_snprintf(buf, buflen, "UNKNOWN ERROR CODE (%04X)", (unsigned int) use_ret);
+    } else {
+        mbedtls_snprintf(buf, buflen, "%s", low_level_error_description);
+    }
+}
+
+#else /* MBEDTLS_ERROR_C */
+
+/*
+ * Provide a dummy implementation when MBEDTLS_ERROR_C is not defined
+ */
+void mbedtls_strerror(int ret, char *buf, size_t buflen)
+{
+    ((void) ret);
+
+    if (buflen > 0) {
+        buf[0] = '\0';
+    }
+}
+
+#endif /* MBEDTLS_ERROR_C */
+
+#endif /* MBEDTLS_ERROR_C || MBEDTLS_ERROR_STRERROR_DUMMY */

vendor/mbedtls/scripts/data_files/query_config.fmt

@@ -0,0 +1,121 @@
+/*
+ *  Query Mbed TLS compile time configurations from mbedtls_config.h
+ *
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ */
+
+#include "mbedtls/build_info.h"
+
+#include "query_config.h"
+
+#include "mbedtls/platform.h"
+
+/*
+ * Include all the headers with public APIs in case they define a macro to its
+ * default value when that configuration is not set in mbedtls_config.h, or
+ * for PSA_WANT macros, in case they're auto-defined based on mbedtls_config.h
+ * rather than defined directly in crypto_config.h.
+ */
+#include "psa/crypto.h"
+
+#include "mbedtls/aes.h"
+#include "mbedtls/aria.h"
+#include "mbedtls/asn1.h"
+#include "mbedtls/asn1write.h"
+#include "mbedtls/base64.h"
+#include "mbedtls/bignum.h"
+#include "mbedtls/camellia.h"
+#include "mbedtls/ccm.h"
+#include "mbedtls/chacha20.h"
+#include "mbedtls/chachapoly.h"
+#include "mbedtls/cipher.h"
+#include "mbedtls/cmac.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/debug.h"
+#include "mbedtls/des.h"
+#include "mbedtls/dhm.h"
+#include "mbedtls/ecdh.h"
+#include "mbedtls/ecdsa.h"
+#include "mbedtls/ecjpake.h"
+#include "mbedtls/ecp.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/error.h"
+#include "mbedtls/gcm.h"
+#include "mbedtls/hkdf.h"
+#include "mbedtls/hmac_drbg.h"
+#include "mbedtls/md.h"
+#include "mbedtls/md5.h"
+#include "mbedtls/memory_buffer_alloc.h"
+#include "mbedtls/net_sockets.h"
+#include "mbedtls/nist_kw.h"
+#include "mbedtls/oid.h"
+#include "mbedtls/pem.h"
+#include "mbedtls/pk.h"
+#include "mbedtls/pkcs12.h"
+#include "mbedtls/pkcs5.h"
+#if defined(MBEDTLS_HAVE_TIME)
+#include "mbedtls/platform_time.h"
+#endif
+#include "mbedtls/platform_util.h"
+#include "mbedtls/poly1305.h"
+#include "mbedtls/ripemd160.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/sha1.h"
+#include "mbedtls/sha256.h"
+#include "mbedtls/sha512.h"
+#include "mbedtls/ssl.h"
+#include "mbedtls/ssl_cache.h"
+#include "mbedtls/ssl_ciphersuites.h"
+#include "mbedtls/ssl_cookie.h"
+#include "mbedtls/ssl_ticket.h"
+#include "mbedtls/threading.h"
+#include "mbedtls/timing.h"
+#include "mbedtls/version.h"
+#include "mbedtls/x509.h"
+#include "mbedtls/x509_crl.h"
+#include "mbedtls/x509_crt.h"
+#include "mbedtls/x509_csr.h"
+
+#include <string.h>
+
+/*
+ * Helper macros to convert a macro or its expansion into a string
+ * WARNING: This does not work for expanding function-like macros. However,
+ * Mbed TLS does not currently have configuration options used in this fashion.
+ */
+#define MACRO_EXPANSION_TO_STR(macro)   MACRO_NAME_TO_STR(macro)
+#define MACRO_NAME_TO_STR(macro)                                        \
+    mbedtls_printf("%s", strlen( #macro "") > 0 ? #macro "\n" : "")
+
+#define STRINGIFY(macro)  #macro
+#define OUTPUT_MACRO_NAME_VALUE(macro) mbedtls_printf( #macro "%s\n",   \
+                                                       (STRINGIFY(macro) "")[0] != 0 ? "=" STRINGIFY( \
+                                                           macro) : "")
+
+#if defined(_MSC_VER)
+/*
+ * Visual Studio throws the warning 4003 because many Mbed TLS feature macros
+ * are defined empty. This means that from the preprocessor's point of view
+ * the macro MBEDTLS_EXPANSION_TO_STR is being invoked without arguments as
+ * some macros expand to nothing. We suppress that specific warning to get a
+ * clean build and to ensure that tests treating warnings as errors do not
+ * fail.
+ */
+#pragma warning(push)
+#pragma warning(disable:4003)
+#endif /* _MSC_VER */
+
+int query_config(const char *config)
+{
+    CHECK_CONFIG /* If the symbol is not found, return an error */
+    return 1;
+}
+
+void list_config(void)
+{
+    LIST_CONFIG
+}
+#if defined(_MSC_VER)
+#pragma warning(pop)
+#endif /* _MSC_VER */

vendor/mbedtls/scripts/data_files/version_features.fmt

@@ -0,0 +1,50 @@
+/*
+ *  Version feature information
+ *
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ */
+
+#include "common.h"
+
+#if defined(MBEDTLS_VERSION_C)
+
+#include "mbedtls/version.h"
+
+#include <string.h>
+
+static const char * const features[] = {
+#if defined(MBEDTLS_VERSION_FEATURES)
+    FEATURE_DEFINES
+#endif /* MBEDTLS_VERSION_FEATURES */
+    NULL
+};
+
+int mbedtls_version_check_feature(const char *feature)
+{
+    const char * const *idx = features;
+
+    if (*idx == NULL) {
+        return -2;
+    }
+
+    if (feature == NULL) {
+        return -1;
+    }
+
+    if (strncmp(feature, "MBEDTLS_", 8)) {
+        return -1;
+    }
+
+    feature += 8;
+
+    while (*idx != NULL) {
+        if (!strcmp(*idx, feature)) {
+            return 0;
+        }
+        idx++;
+    }
+    return -1;
+}
+
+#endif /* MBEDTLS_VERSION_C */

vendor/mbedtls/scripts/data_files/vs2017-app-template.vcxproj

@@ -0,0 +1,175 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <ItemGroup>
+    <SOURCES>
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="mbedTLS.vcxproj">
+      <Project>{46cf2d25-6a36-4189-b59c-e4815388e554}</Project>
+      <LinkLibraryDependencies>true</LinkLibraryDependencies>
+    </ProjectReference>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid><GUID></ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace><APPNAME></RootNamespace>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v141</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v141</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v141</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v141</PlatformToolset>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+    <IntDir>$(Configuration)\$(TargetName)\</IntDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+    <IntDir>$(Configuration)\$(TargetName)\</IntDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+    <IntDir>$(Configuration)\$(TargetName)\</IntDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+    <IntDir>$(Configuration)\$(TargetName)\</IntDir>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <AdditionalIncludeDirectories>
+INCLUDE_DIRECTORIES
+      </AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>bcrypt.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>Debug</AdditionalLibraryDirectories>
+    </Link>
+    <ProjectReference>
+      <LinkLibraryDependencies>false</LinkLibraryDependencies>
+    </ProjectReference>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <AdditionalIncludeDirectories>
+INCLUDE_DIRECTORIES
+      </AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>bcrypt.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>Debug</AdditionalLibraryDirectories>
+    </Link>
+    <ProjectReference>
+      <LinkLibraryDependencies>false</LinkLibraryDependencies>
+    </ProjectReference>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <AdditionalIncludeDirectories>
+INCLUDE_DIRECTORIES
+      </AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <AdditionalLibraryDirectories>Release</AdditionalLibraryDirectories>
+      <AdditionalDependencies>bcrypt.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <AdditionalIncludeDirectories>
+INCLUDE_DIRECTORIES
+      </AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <AdditionalLibraryDirectories>Release</AdditionalLibraryDirectories>
+      <AdditionalDependencies>bcrypt.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>

vendor/mbedtls/scripts/data_files/vs2017-main-template.vcxproj

@@ -0,0 +1,163 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{46CF2D25-6A36-4189-B59C-E4815388E554}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>mbedTLS</RootNamespace>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v141</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v141</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v141</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v141</PlatformToolset>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+    <IntDir>$(Configuration)\$(TargetName)\</IntDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+    <IntDir>$(Configuration)\$(TargetName)\</IntDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+    <IntDir>$(Configuration)\$(TargetName)\</IntDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+    <IntDir>$(Configuration)\$(TargetName)\</IntDir>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>_USRDLL;MBEDTLS_EXPORTS;KRML_VERIFIED_UINT128;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <AdditionalIncludeDirectories>
+INCLUDE_DIRECTORIES
+      </AdditionalIncludeDirectories>
+      <CompileAs>CompileAsC</CompileAs>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>bcrypt.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>_USRDLL;MBEDTLS_EXPORTS;KRML_VERIFIED_UINT128;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <AdditionalIncludeDirectories>
+INCLUDE_DIRECTORIES
+      </AdditionalIncludeDirectories>
+      <CompileAs>CompileAsC</CompileAs>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>bcrypt.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>NDEBUG;_USRDLL;MBEDTLS_EXPORTS;KRML_VERIFIED_UINT128;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <AdditionalIncludeDirectories>
+INCLUDE_DIRECTORIES
+      </AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <AdditionalDependencies>bcrypt.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN64;NDEBUG;_WINDOWS;_USRDLL;MBEDTLS_EXPORTS;KRML_VERIFIED_UINT128;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <AdditionalIncludeDirectories>
+INCLUDE_DIRECTORIES
+      </AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+HEADER_ENTRIES
+  </ItemGroup>
+  <ItemGroup>
+SOURCE_ENTRIES
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>

vendor/mbedtls/scripts/data_files/vs2017-sln-template.sln

@@ -0,0 +1,30 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 2017
+VisualStudioVersion = 15.0.26228.4
+MinimumVisualStudioVersion = 15.0.26228.4
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "mbedTLS", "mbedTLS.vcxproj", "{46CF2D25-6A36-4189-B59C-E4815388E554}"
+EndProject
+APP_ENTRIES
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Win32 = Debug|Win32
+		Debug|x64 = Debug|x64
+		Release|Win32 = Release|Win32
+		Release|x64 = Release|x64
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{46CF2D25-6A36-4189-B59C-E4815388E554}.Debug|Win32.ActiveCfg = Debug|Win32
+		{46CF2D25-6A36-4189-B59C-E4815388E554}.Debug|Win32.Build.0 = Debug|Win32
+		{46CF2D25-6A36-4189-B59C-E4815388E554}.Debug|x64.ActiveCfg = Debug|x64
+		{46CF2D25-6A36-4189-B59C-E4815388E554}.Debug|x64.Build.0 = Debug|x64
+		{46CF2D25-6A36-4189-B59C-E4815388E554}.Release|Win32.ActiveCfg = Release|Win32
+		{46CF2D25-6A36-4189-B59C-E4815388E554}.Release|Win32.Build.0 = Release|Win32
+		{46CF2D25-6A36-4189-B59C-E4815388E554}.Release|x64.ActiveCfg = Release|x64
+		{46CF2D25-6A36-4189-B59C-E4815388E554}.Release|x64.Build.0 = Release|x64
+CONF_ENTRIES
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

vendor/mbedtls/scripts/driver.requirements.txt

@@ -0,0 +1,19 @@
+# Python package requirements for driver implementers.
+
+# Jinja2 <3.0 needs an older version of markupsafe, but does not
+# declare it.
+#   https://github.com/pallets/markupsafe/issues/282
+#   https://github.com/pallets/jinja/issues/1585
+markupsafe < 2.1
+
+# Use the version of Jinja that's in Ubuntu 20.04.
+# See https://github.com/Mbed-TLS/mbedtls/pull/5067#discussion_r738794607 .
+# Note that Jinja 3.0 drops support for Python 3.5, so we need to support
+# Jinja 2.x as long as we're still using Python 3.5 anywhere.
+# Jinja 2.10.1 doesn't support Python 3.10+
+Jinja2 >= 2.10.1; python_version <  '3.10'
+Jinja2 >= 2.10.3; python_version >= '3.10'
+# Jinja2 >=2.10, <3.0 needs a separate package for type annotations
+types-Jinja2 >= 2.11.9
+jsonschema >= 3.2.0
+types-jsonschema >= 3.2.0

vendor/mbedtls/scripts/ecc-heap.sh

@@ -0,0 +1,87 @@
+#!/bin/sh
+
+# Measure heap usage (and performance) of ECC operations with various values of
+# the relevant tunable compile-time parameters.
+#
+# Usage (preferably on a 32-bit platform):
+# cmake -D CMAKE_BUILD_TYPE=Release .
+# scripts/ecc-heap.sh | tee ecc-heap.log
+#
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+set -eu
+
+CONFIG_H='include/mbedtls/mbedtls_config.h'
+
+if [ -r $CONFIG_H ]; then :; else
+    echo "$CONFIG_H not found" >&2
+    exit 1
+fi
+
+if grep -i cmake Makefile >/dev/null; then :; else
+    echo "Needs Cmake" >&2
+    exit 1
+fi
+
+if git status | grep -F $CONFIG_H >/dev/null 2>&1; then
+    echo "mbedtls_config.h not clean" >&2
+    exit 1
+fi
+
+CONFIG_BAK=${CONFIG_H}.bak
+cp $CONFIG_H $CONFIG_BAK
+
+cat << EOF >$CONFIG_H
+#define MBEDTLS_PLATFORM_C
+#define MBEDTLS_PLATFORM_MEMORY
+#define MBEDTLS_MEMORY_BUFFER_ALLOC_C
+#define MBEDTLS_MEMORY_DEBUG
+
+#define MBEDTLS_TIMING_C
+
+#define MBEDTLS_BIGNUM_C
+#define MBEDTLS_ECP_C
+#define MBEDTLS_ASN1_PARSE_C
+#define MBEDTLS_ASN1_WRITE_C
+#define MBEDTLS_ECDSA_C
+#define MBEDTLS_SHA256_C // ECDSA benchmark needs it
+#define MBEDTLS_SHA224_C // SHA256 requires this for now
+#define MBEDTLS_ECDH_C
+
+// NIST curves >= 256 bits
+#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
+#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
+#define MBEDTLS_ECP_DP_SECP521R1_ENABLED
+// SECP "koblitz-like" curve >= 256 bits
+#define MBEDTLS_ECP_DP_SECP256K1_ENABLED
+// Brainpool curves (no specialised "mod p" routine)
+#define MBEDTLS_ECP_DP_BP256R1_ENABLED
+#define MBEDTLS_ECP_DP_BP384R1_ENABLED
+#define MBEDTLS_ECP_DP_BP512R1_ENABLED
+// Montgomery curves
+#define MBEDTLS_ECP_DP_CURVE25519_ENABLED
+#define MBEDTLS_ECP_DP_CURVE448_ENABLED
+
+#define MBEDTLS_HAVE_ASM // just make things a bit faster
+#define MBEDTLS_ECP_NIST_OPTIM // faster and less allocations
+
+//#define MBEDTLS_ECP_WINDOW_SIZE            4
+//#define MBEDTLS_ECP_FIXED_POINT_OPTIM      1
+EOF
+
+for F in 0 1; do
+    for W in 2 3 4; do
+        scripts/config.py set MBEDTLS_ECP_WINDOW_SIZE $W
+        scripts/config.py set MBEDTLS_ECP_FIXED_POINT_OPTIM $F
+        make benchmark >/dev/null 2>&1
+        echo "fixed point optim = $F, max window size = $W"
+        echo "--------------------------------------------"
+        programs/test/benchmark ecdh ecdsa
+    done
+done
+
+# cleanup
+
+mv $CONFIG_BAK $CONFIG_H
+make clean

vendor/mbedtls/scripts/footprint.sh

@@ -0,0 +1,108 @@
+#!/bin/sh
+#
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+#
+# Purpose
+#
+# This script determines ROM size (or code size) for the standard Mbed TLS
+# configurations, when built for a Cortex M3/M4 target.
+#
+# Configurations included:
+#   default    include/mbedtls/mbedtls_config.h
+#   thread     configs/config-thread.h
+#   suite-b    configs/config-suite-b.h
+#   psk        configs/config-ccm-psk-tls1_2.h
+#
+# Usage: footprint.sh
+#
+set -eu
+
+CONFIG_H='include/mbedtls/mbedtls_config.h'
+
+if [ -r $CONFIG_H ]; then :; else
+    echo "$CONFIG_H not found" >&2
+    echo "This script needs to be run from the root of" >&2
+    echo "a git checkout or uncompressed tarball" >&2
+    exit 1
+fi
+
+if grep -i cmake Makefile >/dev/null; then
+    echo "Not compatible with CMake" >&2
+    exit 1
+fi
+
+if which arm-none-eabi-gcc >/dev/null 2>&1; then :; else
+    echo "You need the ARM-GCC toolchain in your path" >&2
+    echo "See https://launchpad.net/gcc-arm-embedded/" >&2
+    exit 1
+fi
+
+ARMGCC_FLAGS='-Os -march=armv7-m -mthumb'
+OUTFILE='00-footprint-summary.txt'
+
+log()
+{
+    echo "$@"
+    echo "$@" >> "$OUTFILE"
+}
+
+doit()
+{
+    NAME="$1"
+    FILE="$2"
+
+    log ""
+    log "$NAME ($FILE):"
+
+    cp $CONFIG_H ${CONFIG_H}.bak
+    if [ "$FILE" != $CONFIG_H ]; then
+        cp "$FILE"  $CONFIG_H
+    fi
+
+    {
+        scripts/config.py unset MBEDTLS_NET_C || true
+        scripts/config.py unset MBEDTLS_TIMING_C || true
+        scripts/config.py unset MBEDTLS_FS_IO || true
+        scripts/config.py --force set MBEDTLS_NO_PLATFORM_ENTROPY || true
+    } >/dev/null 2>&1
+
+    make clean >/dev/null
+    CC=arm-none-eabi-gcc AR=arm-none-eabi-ar LD=arm-none-eabi-ld \
+        CFLAGS="$ARMGCC_FLAGS" make lib >/dev/null
+
+    OUT="size-${NAME}.txt"
+    arm-none-eabi-size -t library/libmbed*.a > "$OUT"
+    log "$( head -n1 "$OUT" )"
+    log "$( tail -n1 "$OUT" )"
+
+    cp ${CONFIG_H}.bak $CONFIG_H
+}
+
+# truncate the file just this time
+echo "(generated by $0)" > "$OUTFILE"
+echo "" >> "$OUTFILE"
+
+log "Footprint of standard configurations (minus net_sockets.c, timing.c, fs_io)"
+log "for bare-metal ARM Cortex-M3/M4 microcontrollers."
+
+VERSION_H="include/mbedtls/version.h"
+MBEDTLS_VERSION=$( sed -n 's/.*VERSION_STRING *"\(.*\)"/\1/p' $VERSION_H )
+if git rev-parse HEAD >/dev/null; then
+    GIT_HEAD=$( git rev-parse HEAD | head -c 10 )
+    GIT_VERSION=" (git head: $GIT_HEAD)"
+else
+    GIT_VERSION=""
+fi
+
+log ""
+log "Mbed TLS $MBEDTLS_VERSION$GIT_VERSION"
+log "$( arm-none-eabi-gcc --version | head -n1 )"
+log "CFLAGS=$ARMGCC_FLAGS"
+
+doit default    include/mbedtls/mbedtls_config.h
+doit thread     configs/config-thread.h
+doit suite-b    configs/config-suite-b.h
+doit psk        configs/config-ccm-psk-tls1_2.h
+
+zip mbedtls-footprint.zip "$OUTFILE" size-*.txt >/dev/null

vendor/mbedtls/scripts/framework_scripts_path.py

@@ -0,0 +1,17 @@
+"""Add our Python library directory to the module search path.
+
+Usage:
+
+    import framework_scripts_path # pylint: disable=unused-import
+"""
+
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+#
+
+import os
+import sys
+
+sys.path.append(os.path.join(os.path.dirname(__file__),
+                             os.path.pardir,
+                             'framework', 'scripts'))

vendor/mbedtls/scripts/generate_driver_wrappers.py

@@ -0,0 +1,214 @@
+#!/usr/bin/env python3
+"""Generate library/psa_crypto_driver_wrappers.h
+            library/psa_crypto_driver_wrappers_no_static.c
+
+   This module is invoked by the build scripts to auto generate the
+   psa_crypto_driver_wrappers.h and psa_crypto_driver_wrappers_no_static
+   based on template files in script/data_files/driver_templates/.
+"""
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+import sys
+import os
+import json
+from typing import NewType, Dict, Any
+from traceback import format_tb
+import argparse
+import jsonschema
+import jinja2
+
+import framework_scripts_path # pylint: disable=unused-import
+from mbedtls_framework import build_tree
+
+JSONSchema = NewType('JSONSchema', object)
+# The Driver is an Object, but practically it's indexable and can called a dictionary to
+# keep MyPy happy till MyPy comes with a more composite type for JsonObjects.
+Driver = NewType('Driver', dict)
+
+
+class JsonValidationException(Exception):
+    def __init__(self, message="Json Validation Failed"):
+        self.message = message
+        super().__init__(self.message)
+
+
+class DriverReaderException(Exception):
+    def __init__(self, message="Driver Reader Failed"):
+        self.message = message
+        super().__init__(self.message)
+
+
+def render(template_path: str, driver_jsoncontext: list) -> str:
+    """
+    Render template from the input file and driver JSON.
+    """
+    environment = jinja2.Environment(
+        loader=jinja2.FileSystemLoader(os.path.dirname(template_path)),
+        keep_trailing_newline=True)
+    template = environment.get_template(os.path.basename(template_path))
+
+    return template.render(drivers=driver_jsoncontext)
+
+def generate_driver_wrapper_file(template_dir: str,
+                                 output_dir: str,
+                                 template_file_name: str,
+                                 driver_jsoncontext: list) -> None:
+    """
+    Generate the file psa_crypto_driver_wrapper.c.
+    """
+    driver_wrapper_template_filename = \
+        os.path.join(template_dir, template_file_name)
+
+    result = render(driver_wrapper_template_filename, driver_jsoncontext)
+
+    with open(file=os.path.join(output_dir, os.path.splitext(template_file_name)[0]),
+              mode='w',
+              encoding='UTF-8') as out_file:
+        out_file.write(result)
+
+
+def validate_json(driverjson_data: Driver, driverschema_list: dict) -> None:
+    """
+    Validate the Driver JSON against an appropriate schema
+    the schema passed could be that matching an opaque/ transparent driver.
+    """
+    driver_type = driverjson_data["type"]
+    driver_prefix = driverjson_data["prefix"]
+    try:
+        _schema = driverschema_list[driver_type]
+        jsonschema.validate(instance=driverjson_data, schema=_schema)
+    except KeyError as err:
+        # This could happen if the driverjson_data.type does not exist in the provided schema list
+        # schemas = {'transparent': transparent_driver_schema, 'opaque': opaque_driver_schema}
+        # Print onto stdout and stderr.
+        print("Unknown Driver type " + driver_type +
+              " for driver " + driver_prefix, str(err))
+        print("Unknown Driver type " + driver_type +
+              " for driver " + driver_prefix, str(err), file=sys.stderr)
+        raise JsonValidationException() from err
+
+    except jsonschema.exceptions.ValidationError as err:
+        # Print onto stdout and stderr.
+        print("Error: Failed to validate data file: {} using schema: {}."
+              "\n Exception Message: \"{}\""
+              " ".format(driverjson_data, _schema, str(err)))
+        print("Error: Failed to validate data file: {} using schema: {}."
+              "\n Exception Message: \"{}\""
+              " ".format(driverjson_data, _schema, str(err)), file=sys.stderr)
+        raise JsonValidationException() from err
+
+
+def load_driver(schemas: Dict[str, Any], driver_file: str) -> Any:
+    """loads validated json driver"""
+    with open(file=driver_file, mode='r', encoding='UTF-8') as f:
+        json_data = json.load(f)
+        try:
+            validate_json(json_data, schemas)
+        except JsonValidationException as e:
+            raise DriverReaderException from e
+        return json_data
+
+
+def load_schemas(project_root: str) -> Dict[str, Any]:
+    """
+    Load schemas map
+    """
+    schema_file_paths = {
+        'transparent': os.path.join(project_root,
+                                    'scripts',
+                                    'data_files',
+                                    'driver_jsons',
+                                    'driver_transparent_schema.json'),
+        'opaque': os.path.join(project_root,
+                               'scripts',
+                               'data_files',
+                               'driver_jsons',
+                               'driver_opaque_schema.json')
+    }
+    driver_schema = {}
+    for key, file_path in schema_file_paths.items():
+        with open(file=file_path, mode='r', encoding='UTF-8') as file:
+            driver_schema[key] = json.load(file)
+    return driver_schema
+
+
+def read_driver_descriptions(project_root: str,
+                             json_directory: str,
+                             jsondriver_list: str) -> list:
+    """
+    Merge driver JSON files into a single ordered JSON after validation.
+    """
+    driver_schema = load_schemas(project_root)
+
+    with open(file=os.path.join(json_directory, jsondriver_list),
+              mode='r',
+              encoding='UTF-8') as driver_list_file:
+        driver_list = json.load(driver_list_file)
+
+    return [load_driver(schemas=driver_schema,
+                        driver_file=os.path.join(json_directory, driver_file_name))
+            for driver_file_name in driver_list]
+
+
+def trace_exception(e: Exception, file=sys.stderr) -> None:
+    """Prints exception trace to the given TextIO handle"""
+    print("Exception: type: %s, message: %s, trace: %s" % (
+        e.__class__, str(e), format_tb(e.__traceback__)
+    ), file)
+
+
+TEMPLATE_FILENAMES = ["psa_crypto_driver_wrappers.h.jinja",
+                      "psa_crypto_driver_wrappers_no_static.c.jinja"]
+
+def main() -> int:
+    """
+    Main with command line arguments.
+    """
+    def_arg_project_root = build_tree.guess_project_root()
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--project-root', default=def_arg_project_root,
+                        help='root directory of repo source code')
+    parser.add_argument('--template-dir',
+                        help='directory holding the driver templates')
+    parser.add_argument('--json-dir',
+                        help='directory holding the driver JSONs')
+    parser.add_argument('output_directory', nargs='?',
+                        help='output file\'s location')
+    args = parser.parse_args()
+
+    project_root = os.path.abspath(args.project_root)
+
+    crypto_core_directory = build_tree.crypto_core_directory(project_root)
+
+    output_directory = args.output_directory if args.output_directory is not None else \
+        crypto_core_directory
+
+    template_directory = args.template_dir if args.template_dir is not None else \
+        os.path.join(project_root,
+                     'scripts',
+                     'data_files',
+                     'driver_templates')
+    json_directory = args.json_dir if args.json_dir is not None else \
+        os.path.join(project_root,
+                     'scripts',
+                     'data_files',
+                     'driver_jsons')
+
+    try:
+        # Read and validate list of driver jsons from driverlist.json
+        merged_driver_json = read_driver_descriptions(project_root,
+                                                      json_directory,
+                                                      'driverlist.json')
+    except DriverReaderException as e:
+        trace_exception(e)
+        return 1
+    for template_filename in TEMPLATE_FILENAMES:
+        generate_driver_wrapper_file(template_directory, output_directory,
+                                     template_filename, merged_driver_json)
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())

vendor/mbedtls/scripts/generate_errors.pl

@@ -0,0 +1,240 @@
+#!/usr/bin/env perl
+
+# Generate error.c
+#
+# Usage: ./generate_errors.pl or scripts/generate_errors.pl without arguments,
+# or generate_errors.pl include_dir data_dir error_file
+#
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+use strict;
+use warnings;
+
+my ($include_dir, $data_dir, $error_file);
+
+if( @ARGV ) {
+    die "Invalid number of arguments" if scalar @ARGV != 3;
+    ($include_dir, $data_dir, $error_file) = @ARGV;
+
+    -d $include_dir or die "No such directory: $include_dir\n";
+    -d $data_dir or die "No such directory: $data_dir\n";
+} else {
+    $include_dir = 'include/mbedtls';
+    $data_dir = 'scripts/data_files';
+    $error_file = 'library/error.c';
+
+    unless( -d $include_dir && -d $data_dir ) {
+        chdir '..' or die;
+        -d $include_dir && -d $data_dir
+            or die "Without arguments, must be run from root or scripts\n"
+    }
+}
+
+my $error_format_file = $data_dir.'/error.fmt';
+
+my @low_level_modules = qw( AES ARIA ASN1 BASE64 BIGNUM
+                            CAMELLIA CCM CHACHA20 CHACHAPOLY CMAC CTR_DRBG DES
+                            ENTROPY ERROR GCM HKDF HMAC_DRBG LMS MD5
+                            NET OID PADLOCK PBKDF2 PLATFORM POLY1305 RIPEMD160
+                            SHA1 SHA256 SHA512 SHA3 THREADING );
+my @high_level_modules = qw( CIPHER DHM ECP MD
+                             PEM PK PKCS12 PKCS5
+                             RSA SSL X509 PKCS7 );
+
+undef $/;
+
+open(FORMAT_FILE, '<:crlf', "$error_format_file") or die "Opening error format file '$error_format_file': $!";
+my $error_format = <FORMAT_FILE>;
+close(FORMAT_FILE);
+
+my @files = glob qq("$include_dir/*.h");
+my @necessary_include_files;
+my @matches;
+foreach my $file (@files) {
+    open(FILE, '<:crlf', $file) or die("$0: $file: $!");
+    my $content = <FILE>;
+    close FILE;
+    my $found = 0;
+    while ($content =~ m[
+            # Both the before-comment and the after-comment are optional.
+            # Only the comment content is a regex capture group. The comment
+            # start and end parts are outside the capture group.
+            (?:/\*[*!](?!<)             # Doxygen before-comment start
+                ((?:[^*]|\*+[^*/])*)    # $1: Comment content (no */ inside)
+                \*/)?                   # Comment end
+            \s*\#\s*define\s+(MBEDTLS_ERR_\w+)  # $2: name
+            \s+\-(0[Xx][0-9A-Fa-f]+)\s*         # $3: value (without the sign)
+            (?:/\*[*!]<                 # Doxygen after-comment start
+                ((?:[^*]|\*+[^*/])*)    # $4: Comment content (no */ inside)
+                \*/)?                   # Comment end
+    ]gsx) {
+        my ($before, $name, $value, $after) = ($1, $2, $3, $4);
+        # Discard Doxygen comments that are coincidentally present before
+        # an error definition but not attached to it. This is ad hoc, based
+        # on what actually matters (or mattered at some point).
+        undef $before if defined($before) && $before =~ /\s*\\name\s/s;
+        die "Description neither before nor after $name in $file\n"
+          if !defined($before) && !defined($after);
+        die "Description both before and after $name in $file\n"
+          if defined($before) && defined($after);
+        my $description = (defined($before) ? $before : $after);
+        $description =~ s/^\s+//;
+        $description =~ s/\n( *\*)? */ /g;
+        $description =~ s/\.?\s+$//;
+        push @matches, [$name, $value, $description];
+        ++$found;
+    }
+    if ($found) {
+        my $include_name = $file;
+        $include_name =~ s!.*/!!;
+        push @necessary_include_files, $include_name;
+    }
+}
+
+my $ll_old_define = "";
+my $hl_old_define = "";
+
+my $ll_code_check = "";
+my $hl_code_check = "";
+
+my $headers = "";
+my %included_headers;
+
+my %error_codes_seen;
+
+foreach my $match (@matches)
+{
+    my ($error_name, $error_code, $description) = @$match;
+
+    die "Duplicated error code: $error_code ($error_name)\n"
+        if( $error_codes_seen{$error_code}++ );
+
+    $description =~ s/\\/\\\\/g;
+
+    my ($module_name) = $error_name =~ /^MBEDTLS_ERR_([^_]+)/;
+
+    # Fix faulty ones
+    $module_name = "BIGNUM" if ($module_name eq "MPI");
+    $module_name = "CTR_DRBG" if ($module_name eq "CTR");
+    $module_name = "HMAC_DRBG" if ($module_name eq "HMAC");
+
+    my $define_name = $module_name;
+    $define_name = "X509_USE,X509_CREATE" if ($define_name eq "X509");
+    $define_name = "ASN1_PARSE" if ($define_name eq "ASN1");
+    $define_name = "SSL_TLS" if ($define_name eq "SSL");
+    $define_name = "PEM_PARSE,PEM_WRITE" if ($define_name eq "PEM");
+    $define_name = "PKCS7" if ($define_name eq "PKCS7");
+
+    my $include_name = $module_name;
+    $include_name =~ tr/A-Z/a-z/;
+
+    # Fix faulty ones
+    $include_name = "net_sockets" if ($module_name eq "NET");
+
+    $included_headers{"${include_name}.h"} = $module_name;
+
+    my $found_ll = grep $_ eq $module_name, @low_level_modules;
+    my $found_hl = grep $_ eq $module_name, @high_level_modules;
+    if (!$found_ll && !$found_hl)
+    {
+        printf("Error: Do not know how to handle: $module_name\n");
+        exit 1;
+    }
+
+    my $code_check;
+    my $old_define;
+    my $white_space;
+    my $first;
+
+    if ($found_ll)
+    {
+        $code_check = \$ll_code_check;
+        $old_define = \$ll_old_define;
+        $white_space = '        ';
+    }
+    else
+    {
+        $code_check = \$hl_code_check;
+        $old_define = \$hl_old_define;
+        $white_space = '        ';
+    }
+
+    if ($define_name ne ${$old_define})
+    {
+        if (${$old_define} ne "")
+        {
+            ${$code_check} .= "#endif /* ";
+            $first = 0;
+            foreach my $dep (split(/,/, ${$old_define}))
+            {
+                ${$code_check} .= " || " if ($first++);
+                ${$code_check} .= "MBEDTLS_${dep}_C";
+            }
+            ${$code_check} .= " */\n\n";
+        }
+
+        ${$code_check} .= "#if ";
+        $headers .= "#if " if ($include_name ne "");
+        $first = 0;
+        foreach my $dep (split(/,/, ${define_name}))
+        {
+            ${$code_check} .= " || " if ($first);
+            $headers       .= " || " if ($first++);
+
+            ${$code_check} .= "defined(MBEDTLS_${dep}_C)";
+            $headers       .= "defined(MBEDTLS_${dep}_C)" if
+                                                    ($include_name ne "");
+        }
+        ${$code_check} .= "\n";
+        $headers .= "\n#include \"mbedtls/${include_name}.h\"\n".
+                    "#endif\n\n" if ($include_name ne "");
+        ${$old_define} = $define_name;
+    }
+
+    ${$code_check} .= "${white_space}case -($error_name):\n".
+                      "${white_space}    return( \"$module_name - $description\" );\n"
+};
+
+if ($ll_old_define ne "")
+{
+    $ll_code_check .= "#endif /* ";
+    my $first = 0;
+    foreach my $dep (split(/,/, $ll_old_define))
+    {
+        $ll_code_check .= " || " if ($first++);
+        $ll_code_check .= "MBEDTLS_${dep}_C";
+    }
+    $ll_code_check .= " */\n";
+}
+if ($hl_old_define ne "")
+{
+    $hl_code_check .= "#endif /* ";
+    my $first = 0;
+    foreach my $dep (split(/,/, $hl_old_define))
+    {
+        $hl_code_check .= " || " if ($first++);
+        $hl_code_check .= "MBEDTLS_${dep}_C";
+    }
+    $hl_code_check .= " */\n";
+}
+
+$error_format =~ s/HEADER_INCLUDED\n/$headers/g;
+$error_format =~ s/LOW_LEVEL_CODE_CHECKS\n/$ll_code_check/g;
+$error_format =~ s/HIGH_LEVEL_CODE_CHECKS\n/$hl_code_check/g;
+
+open(ERROR_FILE, ">$error_file") or die "Opening destination file '$error_file': $!";
+print ERROR_FILE $error_format;
+close(ERROR_FILE);
+
+my $errors = 0;
+for my $include_name (@necessary_include_files)
+{
+    if (not $included_headers{$include_name})
+    {
+        print STDERR "The header file \"$include_name\" defines error codes but has not been included!\n";
+        ++$errors;
+    }
+}
+
+exit !!$errors;

vendor/mbedtls/scripts/generate_features.pl

@@ -0,0 +1,79 @@
+#!/usr/bin/env perl
+#
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+use strict;
+
+my ($include_dir, $data_dir, $feature_file);
+
+if( @ARGV ) {
+    die "Invalid number of arguments" if scalar @ARGV != 3;
+    ($include_dir, $data_dir, $feature_file) = @ARGV;
+
+    -d $include_dir or die "No such directory: $include_dir\n";
+    -d $data_dir or die "No such directory: $data_dir\n";
+} else {
+    $include_dir = 'include/mbedtls';
+    $data_dir = 'scripts/data_files';
+    $feature_file = 'library/version_features.c';
+
+    unless( -d $include_dir && -d $data_dir ) {
+        chdir '..' or die;
+        -d $include_dir && -d $data_dir
+            or die "Without arguments, must be run from root or scripts\n"
+    }
+}
+
+my $feature_format_file = $data_dir.'/version_features.fmt';
+
+my @sections = ( "System support", "Mbed TLS modules",
+                 "Mbed TLS feature support" );
+
+my $line_separator = $/;
+undef $/;
+
+open(FORMAT_FILE, '<:crlf', "$feature_format_file") or die "Opening feature format file '$feature_format_file': $!";
+my $feature_format = <FORMAT_FILE>;
+close(FORMAT_FILE);
+
+$/ = $line_separator;
+
+open(CONFIG_H, '<:crlf', "$include_dir/mbedtls_config.h") || die("Failure when opening mbedtls_config.h: $!");
+
+my $feature_defines = "";
+my $in_section = 0;
+
+while (my $line = <CONFIG_H>)
+{
+    next if ($in_section && $line !~ /#define/ && $line !~ /SECTION/);
+    next if (!$in_section && $line !~ /SECTION/);
+
+    if ($in_section) {
+        if ($line =~ /SECTION/) {
+            $in_section = 0;
+            next;
+        }
+        # Strip leading MBEDTLS_ to save binary size
+        my ($mbedtls_prefix, $define) = $line =~ /#define (MBEDTLS_)?(\w+)/;
+        if (!$mbedtls_prefix) {
+            die "Feature does not start with 'MBEDTLS_': $line\n";
+        }
+        $feature_defines .= "#if defined(MBEDTLS_${define})\n";
+        $feature_defines .= "    \"${define}\", //no-check-names\n";
+        $feature_defines .= "#endif /* MBEDTLS_${define} */\n";
+    }
+
+    if (!$in_section) {
+        my ($section_name) = $line =~ /SECTION: ([\w ]+)/;
+        my $found_section = grep $_ eq $section_name, @sections;
+
+        $in_section = 1 if ($found_section);
+    }
+};
+
+$feature_format =~ s/FEATURE_DEFINES\n/$feature_defines/g;
+
+open(ERROR_FILE, ">$feature_file") or die "Opening destination file '$feature_file': $!";
+print ERROR_FILE $feature_format;
+close(ERROR_FILE);

vendor/mbedtls/scripts/generate_psa_constants.py

@@ -0,0 +1,333 @@
+#!/usr/bin/env python3
+
+"""Generate psa_constant_names_generated.c
+which is included by programs/psa/psa_constant_names.c.
+The code generated by this module is only meant to be used in the context
+of that program.
+
+An argument passed to this script will modify the output directory where the
+file is written:
+* by default (no arguments passed): writes to programs/psa/
+* OUTPUT_FILE_DIR passed: writes to OUTPUT_FILE_DIR/
+"""
+
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+import os
+import sys
+
+import framework_scripts_path # pylint: disable=unused-import
+from mbedtls_framework import build_tree
+from mbedtls_framework import macro_collector
+
+OUTPUT_TEMPLATE = '''\
+/* Automatically generated by generate_psa_constant.py. DO NOT EDIT. */
+
+static const char *psa_strerror(psa_status_t status)
+{
+    switch (status) {
+    %(status_cases)s
+    default: return NULL;
+    }
+}
+
+static const char *psa_ecc_family_name(psa_ecc_family_t curve)
+{
+    switch (curve) {
+    %(ecc_curve_cases)s
+    default: return NULL;
+    }
+}
+
+static const char *psa_dh_family_name(psa_dh_family_t group)
+{
+    switch (group) {
+    %(dh_group_cases)s
+    default: return NULL;
+    }
+}
+
+static const char *psa_hash_algorithm_name(psa_algorithm_t hash_alg)
+{
+    switch (hash_alg) {
+    %(hash_algorithm_cases)s
+    default: return NULL;
+    }
+}
+
+static const char *psa_ka_algorithm_name(psa_algorithm_t ka_alg)
+{
+    switch (ka_alg) {
+    %(ka_algorithm_cases)s
+    default: return NULL;
+    }
+}
+
+static int psa_snprint_key_type(char *buffer, size_t buffer_size,
+                                psa_key_type_t type)
+{
+    size_t required_size = 0;
+    switch (type) {
+    %(key_type_cases)s
+    default:
+        %(key_type_code)s{
+            return snprintf(buffer, buffer_size,
+                            "0x%%04x", (unsigned) type);
+        }
+        break;
+    }
+    buffer[0] = 0;
+    return (int) required_size;
+}
+
+#define NO_LENGTH_MODIFIER 0xfffffffflu
+static int psa_snprint_algorithm(char *buffer, size_t buffer_size,
+                                 psa_algorithm_t alg)
+{
+    size_t required_size = 0;
+    psa_algorithm_t core_alg = alg;
+    unsigned long length_modifier = NO_LENGTH_MODIFIER;
+    if (PSA_ALG_IS_MAC(alg)) {
+        core_alg = PSA_ALG_TRUNCATED_MAC(alg, 0);
+        if (alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) {
+            append(&buffer, buffer_size, &required_size,
+                   "PSA_ALG_AT_LEAST_THIS_LENGTH_MAC(", 33);
+            length_modifier = PSA_MAC_TRUNCATED_LENGTH(alg);
+        } else if (core_alg != alg) {
+            append(&buffer, buffer_size, &required_size,
+                   "PSA_ALG_TRUNCATED_MAC(", 22);
+            length_modifier = PSA_MAC_TRUNCATED_LENGTH(alg);
+        }
+    } else if (PSA_ALG_IS_AEAD(alg)) {
+        core_alg = PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG(alg);
+        if (core_alg == 0) {
+            /* For unknown AEAD algorithms, there is no "default tag length". */
+            core_alg = alg;
+        } else if (alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) {
+            append(&buffer, buffer_size, &required_size,
+                   "PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG(", 43);
+            length_modifier = PSA_ALG_AEAD_GET_TAG_LENGTH(alg);
+        } else if (core_alg != alg) {
+            append(&buffer, buffer_size, &required_size,
+                   "PSA_ALG_AEAD_WITH_SHORTENED_TAG(", 32);
+            length_modifier = PSA_ALG_AEAD_GET_TAG_LENGTH(alg);
+        }
+    } else if (PSA_ALG_IS_KEY_AGREEMENT(alg) &&
+               !PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) {
+        core_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF(alg);
+        append(&buffer, buffer_size, &required_size,
+               "PSA_ALG_KEY_AGREEMENT(", 22);
+        append_with_alg(&buffer, buffer_size, &required_size,
+                        psa_ka_algorithm_name,
+                        PSA_ALG_KEY_AGREEMENT_GET_BASE(alg));
+        append(&buffer, buffer_size, &required_size, ", ", 2);
+    }
+    switch (core_alg) {
+    %(algorithm_cases)s
+    default:
+        %(algorithm_code)s{
+            append_integer(&buffer, buffer_size, &required_size,
+                           "0x%%08lx", (unsigned long) core_alg);
+        }
+        break;
+    }
+    if (core_alg != alg) {
+        if (length_modifier != NO_LENGTH_MODIFIER) {
+            append(&buffer, buffer_size, &required_size, ", ", 2);
+            append_integer(&buffer, buffer_size, &required_size,
+                           "%%lu", length_modifier);
+        }
+        append(&buffer, buffer_size, &required_size, ")", 1);
+    }
+    buffer[0] = 0;
+    return (int) required_size;
+}
+
+static int psa_snprint_key_usage(char *buffer, size_t buffer_size,
+                                 psa_key_usage_t usage)
+{
+    size_t required_size = 0;
+    if (usage == 0) {
+        if (buffer_size > 1) {
+            buffer[0] = '0';
+            buffer[1] = 0;
+        } else if (buffer_size == 1) {
+            buffer[0] = 0;
+        }
+        return 1;
+    }
+%(key_usage_code)s
+    if (usage != 0) {
+        if (required_size != 0) {
+            append(&buffer, buffer_size, &required_size, " | ", 3);
+        }
+        append_integer(&buffer, buffer_size, &required_size,
+                       "0x%%08lx", (unsigned long) usage);
+    } else {
+        buffer[0] = 0;
+    }
+    return (int) required_size;
+}
+
+/* End of automatically generated file. */
+'''
+
+KEY_TYPE_FROM_CURVE_TEMPLATE = '''if (%(tester)s(type)) {
+            append_with_curve(&buffer, buffer_size, &required_size,
+                              "%(builder)s", %(builder_length)s,
+                              PSA_KEY_TYPE_ECC_GET_FAMILY(type));
+        } else '''
+
+KEY_TYPE_FROM_GROUP_TEMPLATE = '''if (%(tester)s(type)) {
+            append_with_group(&buffer, buffer_size, &required_size,
+                              "%(builder)s", %(builder_length)s,
+                              PSA_KEY_TYPE_DH_GET_FAMILY(type));
+        } else '''
+
+ALGORITHM_FROM_HASH_TEMPLATE = '''if (%(tester)s(core_alg)) {
+            append(&buffer, buffer_size, &required_size,
+                   "%(builder)s(", %(builder_length)s + 1);
+            append_with_alg(&buffer, buffer_size, &required_size,
+                            psa_hash_algorithm_name,
+                            PSA_ALG_GET_HASH(core_alg));
+            append(&buffer, buffer_size, &required_size, ")", 1);
+        } else '''
+
+BIT_TEST_TEMPLATE = '''\
+    if (%(var)s & %(flag)s) {
+        if (required_size != 0) {
+            append(&buffer, buffer_size, &required_size, " | ", 3);
+        }
+        append(&buffer, buffer_size, &required_size, "%(flag)s", %(length)d);
+        %(var)s ^= %(flag)s;
+    }\
+'''
+
+class CaseBuilder(macro_collector.PSAMacroCollector):
+    """Collect PSA crypto macro definitions and write value recognition functions.
+
+    1. Call `read_file` on the input header file(s).
+    2. Call `write_file` to write ``psa_constant_names_generated.c``.
+    """
+
+    def __init__(self):
+        super().__init__(include_intermediate=True)
+
+    @staticmethod
+    def _make_return_case(name):
+        return 'case %(name)s: return "%(name)s";' % {'name': name}
+
+    @staticmethod
+    def _make_append_case(name):
+        template = ('case %(name)s: '
+                    'append(&buffer, buffer_size, &required_size, "%(name)s", %(length)d); '
+                    'break;')
+        return template % {'name': name, 'length': len(name)}
+
+    @staticmethod
+    def _make_bit_test(var, flag):
+        return BIT_TEST_TEMPLATE % {'var': var,
+                                    'flag': flag,
+                                    'length': len(flag)}
+
+    def _make_status_cases(self):
+        return '\n    '.join(map(self._make_return_case,
+                                 sorted(self.statuses)))
+
+    def _make_ecc_curve_cases(self):
+        return '\n    '.join(map(self._make_return_case,
+                                 sorted(self.ecc_curves)))
+
+    def _make_dh_group_cases(self):
+        return '\n    '.join(map(self._make_return_case,
+                                 sorted(self.dh_groups)))
+
+    def _make_key_type_cases(self):
+        return '\n    '.join(map(self._make_append_case,
+                                 sorted(self.key_types)))
+
+    @staticmethod
+    def _make_key_type_from_curve_code(builder, tester):
+        return KEY_TYPE_FROM_CURVE_TEMPLATE % {'builder': builder,
+                                               'builder_length': len(builder),
+                                               'tester': tester}
+
+    @staticmethod
+    def _make_key_type_from_group_code(builder, tester):
+        return KEY_TYPE_FROM_GROUP_TEMPLATE % {'builder': builder,
+                                               'builder_length': len(builder),
+                                               'tester': tester}
+
+    def _make_ecc_key_type_code(self):
+        d = self.key_types_from_curve
+        make = self._make_key_type_from_curve_code
+        return ''.join([make(k, d[k]) for k in sorted(d.keys())])
+
+    def _make_dh_key_type_code(self):
+        d = self.key_types_from_group
+        make = self._make_key_type_from_group_code
+        return ''.join([make(k, d[k]) for k in sorted(d.keys())])
+
+    def _make_hash_algorithm_cases(self):
+        return '\n    '.join(map(self._make_return_case,
+                                 sorted(self.hash_algorithms)))
+
+    def _make_ka_algorithm_cases(self):
+        return '\n    '.join(map(self._make_return_case,
+                                 sorted(self.ka_algorithms)))
+
+    def _make_algorithm_cases(self):
+        return '\n    '.join(map(self._make_append_case,
+                                 sorted(self.algorithms)))
+
+    @staticmethod
+    def _make_algorithm_from_hash_code(builder, tester):
+        return ALGORITHM_FROM_HASH_TEMPLATE % {'builder': builder,
+                                               'builder_length': len(builder),
+                                               'tester': tester}
+
+    def _make_algorithm_code(self):
+        d = self.algorithms_from_hash
+        make = self._make_algorithm_from_hash_code
+        return ''.join([make(k, d[k]) for k in sorted(d.keys())])
+
+    def _make_key_usage_code(self):
+        return '\n'.join([self._make_bit_test('usage', bit)
+                          for bit in sorted(self.key_usage_flags)])
+
+    def write_file(self, output_file):
+        """Generate the pretty-printer function code from the gathered
+        constant definitions.
+        """
+        data = {}
+        data['status_cases'] = self._make_status_cases()
+        data['ecc_curve_cases'] = self._make_ecc_curve_cases()
+        data['dh_group_cases'] = self._make_dh_group_cases()
+        data['key_type_cases'] = self._make_key_type_cases()
+        data['key_type_code'] = (self._make_ecc_key_type_code() +
+                                 self._make_dh_key_type_code())
+        data['hash_algorithm_cases'] = self._make_hash_algorithm_cases()
+        data['ka_algorithm_cases'] = self._make_ka_algorithm_cases()
+        data['algorithm_cases'] = self._make_algorithm_cases()
+        data['algorithm_code'] = self._make_algorithm_code()
+        data['key_usage_code'] = self._make_key_usage_code()
+        output_file.write(OUTPUT_TEMPLATE % data)
+
+def generate_psa_constants(header_file_names, output_file_name):
+    collector = CaseBuilder()
+    for header_file_name in header_file_names:
+        with open(header_file_name, 'rb') as header_file:
+            collector.read_file(header_file)
+    temp_file_name = output_file_name + '.tmp'
+    with open(temp_file_name, 'w') as output_file:
+        collector.write_file(output_file)
+    os.replace(temp_file_name, output_file_name)
+
+if __name__ == '__main__':
+    build_tree.chdir_to_root()
+    # Allow to change the directory where psa_constant_names_generated.c is written to.
+    OUTPUT_FILE_DIR = sys.argv[1] if len(sys.argv) == 2 else "programs/psa"
+    generate_psa_constants(['include/psa/crypto_values.h',
+                            'include/psa/crypto_extra.h'],
+                           OUTPUT_FILE_DIR + '/psa_constant_names_generated.c')

vendor/mbedtls/scripts/generate_query_config.pl

@@ -0,0 +1,116 @@
+#! /usr/bin/env perl
+
+# Generate query_config.c
+#
+# The file query_config.c contains a C function that can be used to check if
+# a configuration macro is defined and to retrieve its expansion in string
+# form (if any). This facilitates querying the compile time configuration of
+# the library, for example, for testing.
+#
+# The query_config.c is generated from the default configuration files
+# include/mbedtls/mbedtls_config.h and include/psa/crypto_config.h.
+# The idea is that mbedtls_config.h and crypto_config.h contain ALL the
+# compile time configurations available in Mbed TLS (commented or uncommented).
+# This script extracts the configuration macros from the two files and this
+# information is used to automatically generate the body of the query_config()
+# function by using the template in scripts/data_files/query_config.fmt.
+#
+# Usage: scripts/generate_query_config.pl without arguments, or
+# generate_query_config.pl mbedtls_config_file psa_crypto_config_file template_file output_file
+#
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+use strict;
+
+my ($mbedtls_config_file, $psa_crypto_config_file, $query_config_format_file, $query_config_file);
+
+my $default_mbedtls_config_file = "./include/mbedtls/mbedtls_config.h";
+my $default_psa_crypto_config_file = "./include/psa/crypto_config.h";
+my $default_query_config_format_file = "./scripts/data_files/query_config.fmt";
+my $default_query_config_file = "./programs/test/query_config.c";
+
+if( @ARGV ) {
+    die "Invalid number of arguments - usage: $0 [MBED_TLS_CONFIG_FILE PSA_CRYPTO_CONFIG_FILE TEMPLATE_FILE OUTPUT_FILE]" if scalar @ARGV != 4;
+    ($mbedtls_config_file, $psa_crypto_config_file, $query_config_format_file, $query_config_file) = @ARGV;
+
+    -f $mbedtls_config_file or die "No such file: $mbedtls_config_file";
+    -f $psa_crypto_config_file or die "No such file: $psa_crypto_config_file";
+    -f $query_config_format_file or die "No such file: $query_config_format_file";
+} else {
+    $mbedtls_config_file = $default_mbedtls_config_file;
+    $psa_crypto_config_file = $default_psa_crypto_config_file;
+    $query_config_format_file = $default_query_config_format_file;
+    $query_config_file = $default_query_config_file;
+
+    unless(-f $mbedtls_config_file && -f $query_config_format_file  && -f $psa_crypto_config_file) {
+        chdir '..' or die;
+        -f $mbedtls_config_file && -f $query_config_format_file && -f $psa_crypto_config_file
+          or die "No arguments supplied, must be run from project root or a first-level subdirectory\n";
+    }
+}
+
+# Excluded macros from the generated query_config.c. For example, macros that
+# have commas or function-like macros cannot be transformed into strings easily
+# using the preprocessor, so they should be excluded or the preprocessor will
+# throw errors.
+my @excluded = qw(
+MBEDTLS_SSL_CIPHERSUITES
+);
+my $excluded_re = join '|', @excluded;
+
+# This variable will contain the string to replace in the CHECK_CONFIG of the
+# format file
+my $config_check = "";
+my $list_config = "";
+
+for my $config_file ($mbedtls_config_file, $psa_crypto_config_file) {
+
+    next unless defined($config_file);  # we might not have been given a PSA crypto config file
+
+    open(CONFIG_FILE, "<", $config_file) or die "Opening config file '$config_file': $!";
+
+    while (my $line = <CONFIG_FILE>) {
+        if ($line =~ /^(\/\/)?\s*#\s*define\s+(MBEDTLS_\w+|PSA_WANT_\w+).*/) {
+            my $name = $2;
+
+            # Skip over the macro if it is in the excluded list
+            next if $name =~ /$excluded_re/;
+
+            $config_check .= <<EOT;
+#if defined($name)
+    if( strcmp( "$name", config ) == 0 )
+    {
+        MACRO_EXPANSION_TO_STR( $name );
+        return( 0 );
+    }
+#endif /* $name */
+
+EOT
+
+            $list_config .= <<EOT;
+#if defined($name)
+    OUTPUT_MACRO_NAME_VALUE($name);
+#endif /* $name */
+
+EOT
+        }
+    }
+
+    close(CONFIG_FILE);
+}
+
+# Read the full format file into a string
+local $/;
+open(FORMAT_FILE, "<", $query_config_format_file) or die "Opening query config format file '$query_config_format_file': $!";
+my $query_config_format = <FORMAT_FILE>;
+close(FORMAT_FILE);
+
+# Replace the body of the query_config() function with the code we just wrote
+$query_config_format =~ s/CHECK_CONFIG/$config_check/g;
+$query_config_format =~ s/LIST_CONFIG/$list_config/g;
+
+# Rewrite the query_config.c file
+open(QUERY_CONFIG_FILE, ">", $query_config_file) or die "Opening destination file '$query_config_file': $!";
+print QUERY_CONFIG_FILE $query_config_format;
+close(QUERY_CONFIG_FILE);

vendor/mbedtls/scripts/generate_tls_handshake_tests.py

@@ -0,0 +1,14 @@
+#!/usr/bin/env python3
+"""
+Generate miscellaneous TLS test cases relating to the handshake.
+"""
+
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+import framework_scripts_path # pylint: disable=unused-import
+
+from mbedtls_framework import tls_handshake_tests
+
+if __name__ == '__main__':
+    tls_handshake_tests.main()

vendor/mbedtls/scripts/generate_visualc_files.pl

@@ -0,0 +1,307 @@
+#!/usr/bin/env perl
+
+# Generate main file, individual apps and solution files for
+# MS Visual Studio 2017
+#
+# Must be run from Mbed TLS root or scripts directory.
+# Takes no argument.
+#
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+use warnings;
+use strict;
+use Digest::MD5 'md5_hex';
+
+my $vsx_dir = "visualc/VS2017";
+my $vsx_ext = "vcxproj";
+my $vsx_app_tpl_file = "scripts/data_files/vs2017-app-template.$vsx_ext";
+my $vsx_main_tpl_file = "scripts/data_files/vs2017-main-template.$vsx_ext";
+my $vsx_main_file = "$vsx_dir/mbedTLS.$vsx_ext";
+my $vsx_sln_tpl_file = "scripts/data_files/vs2017-sln-template.sln";
+my $vsx_sln_file = "$vsx_dir/mbedTLS.sln";
+
+my $programs_dir = 'programs';
+my $framework_programs_dir = 'framework/tests/programs';
+my $mbedtls_header_dir = 'include/mbedtls';
+my $psa_header_dir = 'include/psa';
+my $source_dir = 'library';
+my $tls_test_source_dir = 'tests/src';
+my $tls_test_header_dir = 'tests/include/test';
+my $test_source_dir = 'framework/tests/src';
+my $test_header_dir = 'framework/tests/include/test';
+my $test_drivers_header_dir = 'framework/tests/include/test/drivers';
+my $test_drivers_source_dir = 'framework/tests/src/drivers';
+
+my @thirdparty_header_dirs = qw(
+    3rdparty/everest/include/everest
+);
+my @thirdparty_source_dirs = qw(
+    3rdparty/everest/library
+    3rdparty/everest/library/kremlib
+    3rdparty/everest/library/legacy
+);
+
+# Directories to add to the include path.
+# Order matters in case there are files with the same name in more than
+# one directory: the compiler will use the first match.
+my @include_directories = qw(
+    include
+    3rdparty/everest/include/
+    3rdparty/everest/include/everest
+    3rdparty/everest/include/everest/vs2013
+    3rdparty/everest/include/everest/kremlib
+    tests/include
+    framework/tests/include
+    framework/tests/programs
+);
+my $include_directories = join(';', map {"../../$_"} @include_directories);
+
+# Directories to add to the include path when building the library, but not
+# when building tests or applications.
+my @library_include_directories = qw(
+    library
+);
+my $library_include_directories =
+  join(';', map {"../../$_"} (@library_include_directories,
+                              @include_directories));
+
+my @excluded_files = qw(
+    3rdparty/everest/library/Hacl_Curve25519.c
+);
+my %excluded_files = ();
+foreach (@excluded_files) { $excluded_files{$_} = 1 }
+
+my $vsx_hdr_tpl = <<EOT;
+    <ClInclude Include="..\\..\\{NAME}" />
+EOT
+my $vsx_src_tpl = <<EOT;
+    <ClCompile Include="..\\..\\{NAME}" />
+EOT
+
+my $vsx_sln_app_entry_tpl = <<EOT;
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "{APPNAME}", "{APPNAME}.vcxproj", "{GUID}"
+	ProjectSection(ProjectDependencies) = postProject
+		{46CF2D25-6A36-4189-B59C-E4815388E554} = {46CF2D25-6A36-4189-B59C-E4815388E554}
+	EndProjectSection
+EndProject
+EOT
+
+my $vsx_sln_conf_entry_tpl = <<EOT;
+		{GUID}.Debug|Win32.ActiveCfg = Debug|Win32
+		{GUID}.Debug|Win32.Build.0 = Debug|Win32
+		{GUID}.Debug|x64.ActiveCfg = Debug|x64
+		{GUID}.Debug|x64.Build.0 = Debug|x64
+		{GUID}.Release|Win32.ActiveCfg = Release|Win32
+		{GUID}.Release|Win32.Build.0 = Release|Win32
+		{GUID}.Release|x64.ActiveCfg = Release|x64
+		{GUID}.Release|x64.Build.0 = Release|x64
+EOT
+
+exit( main() );
+
+sub check_dirs {
+    foreach my $d (@thirdparty_header_dirs, @thirdparty_source_dirs) {
+        if (not (-d $d)) { return 0; }
+    }
+    return -d $vsx_dir
+        && -d $mbedtls_header_dir
+        && -d $psa_header_dir
+        && -d $source_dir
+        && -d $test_source_dir
+        && -d $tls_test_source_dir
+        && -d $test_drivers_source_dir
+        && -d $test_header_dir
+        && -d $tls_test_header_dir
+        && -d $test_drivers_header_dir
+        && -d $programs_dir
+        && -d $framework_programs_dir;
+}
+
+sub slurp_file {
+    my ($filename) = @_;
+
+    local $/ = undef;
+    open my $fh, '<:crlf', $filename or die "Could not read $filename\n";
+    my $content = <$fh>;
+    close $fh;
+
+    return $content;
+}
+
+sub content_to_file {
+    my ($content, $filename) = @_;
+
+    open my $fh, '>:crlf', $filename or die "Could not write to $filename\n";
+    print $fh $content;
+    close $fh;
+}
+
+sub gen_app_guid {
+    my ($path) = @_;
+
+    my $guid = md5_hex( "mbedTLS:$path" );
+    $guid =~ s/(.{8})(.{4})(.{4})(.{4})(.{12})/\U{$1-$2-$3-$4-$5}/;
+
+    return $guid;
+}
+
+sub gen_app {
+    my ($path, $template, $dir, $ext) = @_;
+
+    my $guid = gen_app_guid( $path );
+    $path =~ s!/!\\!g;
+    (my $appname = $path) =~ s/.*\\//;
+    my $is_test_app = ($path =~ m/^test\\/);
+
+    my $srcs;
+    if( $appname eq "metatest" or $appname eq "query_compile_time_config" or
+        $appname eq "query_included_headers" or $appname eq "zeroize" ) {
+        $srcs = "<ClCompile Include=\"..\\..\\framework\\tests\\programs\\$appname.c\" \/>";
+    } else {
+        $srcs = "<ClCompile Include=\"..\\..\\programs\\$path.c\" \/>";
+    }
+
+    if( $appname eq "ssl_client2" or $appname eq "ssl_server2" or
+        $appname eq "query_compile_time_config" ) {
+        $srcs .= "\n    <ClCompile Include=\"..\\..\\programs\\test\\query_config.c\" \/>";
+    }
+    if( $appname eq "ssl_client2" or $appname eq "ssl_server2" ) {
+        $srcs .= "\n    <ClCompile Include=\"..\\..\\programs\\ssl\\ssl_test_lib.c\" \/>";
+    }
+
+    my $content = $template;
+    $content =~ s/<SOURCES>/$srcs/g;
+    $content =~ s/<APPNAME>/$appname/g;
+    $content =~ s/<GUID>/$guid/g;
+    $content =~ s/INCLUDE_DIRECTORIES\n/($is_test_app ?
+                                         $library_include_directories :
+                                         $include_directories)/ge;
+
+    content_to_file( $content, "$dir/$appname.$ext" );
+}
+
+sub get_app_list {
+    my $makefile_contents = slurp_file('programs/Makefile');
+    $makefile_contents =~ /\n\s*APPS\s*=[\\\s]*(.*?)(?<!\\)[\#\n]/s
+      or die "Cannot find APPS = ... in programs/Makefile\n";
+    return split /(?:\s|\\)+/, $1;
+}
+
+sub gen_app_files {
+    my @app_list = @_;
+
+    my $vsx_tpl = slurp_file( $vsx_app_tpl_file );
+
+    for my $app ( @app_list ) {
+        gen_app( $app, $vsx_tpl, $vsx_dir, $vsx_ext );
+    }
+}
+
+sub gen_entry_list {
+    my ($tpl, @names) = @_;
+
+    my $entries;
+    for my $name (@names) {
+        (my $entry = $tpl) =~ s/{NAME}/$name/g;
+        $entries .= $entry;
+    }
+
+    return $entries;
+}
+
+sub gen_main_file {
+    my ($headers, $sources,
+        $hdr_tpl, $src_tpl,
+        $main_tpl, $main_out) = @_;
+
+    my $header_entries = gen_entry_list( $hdr_tpl, @$headers );
+    my $source_entries = gen_entry_list( $src_tpl, @$sources );
+
+    my $out = slurp_file( $main_tpl );
+    $out =~ s/SOURCE_ENTRIES\n/$source_entries/m;
+    $out =~ s/HEADER_ENTRIES\n/$header_entries/m;
+    $out =~ s/INCLUDE_DIRECTORIES\n/$library_include_directories/g;
+
+    content_to_file( $out, $main_out );
+}
+
+sub gen_vsx_solution {
+    my (@app_names) = @_;
+
+    my ($app_entries, $conf_entries);
+    for my $path (@app_names) {
+        my $guid = gen_app_guid( $path );
+        (my $appname = $path) =~ s!.*/!!;
+
+        my $app_entry = $vsx_sln_app_entry_tpl;
+        $app_entry =~ s/{APPNAME}/$appname/g;
+        $app_entry =~ s/{GUID}/$guid/g;
+
+        $app_entries .= $app_entry;
+
+        my $conf_entry = $vsx_sln_conf_entry_tpl;
+        $conf_entry =~ s/{GUID}/$guid/g;
+
+        $conf_entries .= $conf_entry;
+    }
+
+    my $out = slurp_file( $vsx_sln_tpl_file );
+    $out =~ s/APP_ENTRIES\n/$app_entries/m;
+    $out =~ s/CONF_ENTRIES\n/$conf_entries/m;
+
+    content_to_file( $out, $vsx_sln_file );
+}
+
+sub del_vsx_files {
+    unlink glob "'$vsx_dir/*.$vsx_ext'";
+    unlink $vsx_main_file;
+    unlink $vsx_sln_file;
+}
+
+sub main {
+    if( ! check_dirs() ) {
+        chdir '..' or die;
+        check_dirs or die "Must be run from Mbed TLS root or scripts dir\n";
+    }
+
+    # Remove old files to ensure that, for example, project files from deleted
+    # apps are not kept
+    del_vsx_files();
+
+    my @app_list = get_app_list();
+    my @header_dirs = (
+                       $mbedtls_header_dir,
+                       $psa_header_dir,
+                       $test_header_dir,
+                       $tls_test_header_dir,
+                       $test_drivers_header_dir,
+                       $source_dir,
+                       $framework_programs_dir,
+                       @thirdparty_header_dirs,
+                      );
+    my @headers = (map { <$_/*.h> } @header_dirs);
+    my @source_dirs = (
+                       $source_dir,
+                       $test_source_dir,
+                       $tls_test_source_dir,
+                       $test_drivers_source_dir,
+                       @thirdparty_source_dirs,
+                      );
+    my @sources = (map { <$_/*.c> } @source_dirs);
+
+    @headers = grep { ! $excluded_files{$_} } @headers;
+    @sources = grep { ! $excluded_files{$_} } @sources;
+    map { s!/!\\!g } @headers;
+    map { s!/!\\!g } @sources;
+
+    gen_app_files( @app_list );
+
+    gen_main_file( \@headers, \@sources,
+                   $vsx_hdr_tpl, $vsx_src_tpl,
+                   $vsx_main_tpl_file, $vsx_main_file );
+
+    gen_vsx_solution( @app_list );
+
+    return 0;
+}

vendor/mbedtls/scripts/maintainer.requirements.txt

@@ -0,0 +1,10 @@
+# Python packages that are only useful to Mbed TLS maintainers.
+
+-r ci.requirements.txt
+
+# For source code analyses
+clang
+
+# For building some test vectors
+pycryptodomex
+pycryptodome-test-vectors

vendor/mbedtls/scripts/maintainer/maintainer_scripts_path.py

@@ -0,0 +1,20 @@
+"""Add our Python library directories for maintainer scripts to the module search path.
+
+Usage:
+
+    import maintainer_scripts_path # pylint: disable=unused-import
+"""
+
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+#
+
+import os
+import sys
+
+sys.path.append(os.path.join(os.path.dirname(__file__),
+                             os.path.pardir, os.path.pardir,
+                             'framework', 'scripts'))
+sys.path.append(os.path.join(os.path.dirname(__file__),
+                             os.path.pardir, os.path.pardir,
+                             'framework', 'util'))

vendor/mbedtls/scripts/make_generated_files.bat

@@ -0,0 +1,35 @@
+@rem Generate automatically-generated configuration-independent source files
+@rem and build scripts.
+@rem Requirements:
+@rem * Perl must be on the PATH ("perl" command).
+@rem * Python 3.8 or above must be on the PATH ("python" command).
+@rem * Either a C compiler called "cc" must be on the PATH, or
+@rem   the "CC" environment variable must point to a C compiler.
+
+@rem @@@@ library\** @@@@
+@rem psa_crypto_driver_wrappers.h needs to be generated prior to
+@rem generate_visualc_files.pl being invoked.
+python scripts\generate_driver_wrappers.py || exit /b 1
+perl scripts\generate_errors.pl || exit /b 1
+perl scripts\generate_query_config.pl || exit /b 1
+perl scripts\generate_features.pl || exit /b 1
+python framework\scripts\generate_ssl_debug_helpers.py || exit /b 1
+
+@rem @@@@ programs\** @@@@
+python scripts\generate_psa_constants.py || exit /b 1
+
+@rem @@@@ tests\** @@@@
+python framework\scripts\generate_bignum_tests.py || exit /b 1
+python framework\scripts\generate_config_tests.py || exit /b 1
+python framework\scripts\generate_ecp_tests.py || exit /b 1
+python framework\scripts\generate_psa_tests.py || exit /b 1
+python framework\scripts\generate_psa_wrappers.py || exit /b 1
+python framework\scripts\generate_test_keys.py --output tests\include\test\test_keys.h || exit /b 1
+python framework\scripts\generate_test_cert_macros.py --output tests\include\test\test_certs.h || exit /b 1
+python scripts\generate_tls_handshake_tests.py || exit /b 1
+python framework\scripts\generate_tls13_compat_tests.py || exit /b 1
+
+@rem @@@@ Build @@@@
+@rem Call generate_visualc_files.pl last to be sure everything else has been
+@rem generated before.
+perl scripts\generate_visualc_files.pl || exit /b 1

vendor/mbedtls/scripts/memory.sh

@@ -0,0 +1,129 @@
+#!/bin/sh
+
+# Measure memory usage of a minimal client using a small configuration
+# Currently hardwired to ccm-psk and suite-b, may be expanded later
+#
+# Use different build options for measuring executable size and memory usage,
+# since for memory we want debug information.
+#
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+set -eu
+
+CONFIG_H='include/mbedtls/mbedtls_config.h'
+
+CLIENT='mini_client'
+
+CFLAGS_EXEC='-fno-asynchronous-unwind-tables -Wl,--gc-section -ffunction-sections -fdata-sections'
+CFLAGS_MEM=-g3
+
+if [ -r $CONFIG_H ]; then :; else
+    echo "$CONFIG_H not found" >&2
+    exit 1
+fi
+
+if grep -i cmake Makefile >/dev/null; then
+    echo "Not compatible with CMake" >&2
+    exit 1
+fi
+
+if [ $( uname ) != Linux ]; then
+    echo "Only work on Linux" >&2
+    exit 1
+fi
+
+if git status | grep -F $CONFIG_H >/dev/null 2>&1; then
+    echo "mbedtls_config.h not clean" >&2
+    exit 1
+fi
+
+# make measurements with one configuration
+# usage: do_config <name> <unset-list> <server-args>
+do_config()
+{
+    NAME=$1
+    UNSET_LIST=$2
+    SERVER_ARGS=$3
+
+    echo ""
+    echo "config-$NAME:"
+    cp configs/config-$NAME.h $CONFIG_H
+    scripts/config.py unset MBEDTLS_SSL_SRV_C
+
+    for FLAG in $UNSET_LIST; do
+        scripts/config.py unset $FLAG
+    done
+
+    grep -F SSL_MAX_CONTENT_LEN $CONFIG_H || echo 'SSL_MAX_CONTENT_LEN=16384'
+
+    printf "    Executable size... "
+
+    make clean
+    CFLAGS=$CFLAGS_EXEC make OFLAGS=-Os lib >/dev/null 2>&1
+    cd programs
+    CFLAGS=$CFLAGS_EXEC make OFLAGS=-Os ssl/$CLIENT >/dev/null
+    strip ssl/$CLIENT
+    stat -c '%s' ssl/$CLIENT
+    cd ..
+
+    printf "    Peak ram usage... "
+
+    make clean
+    CFLAGS=$CFLAGS_MEM make OFLAGS=-Os lib >/dev/null 2>&1
+    cd programs
+    CFLAGS=$CFLAGS_MEM make OFLAGS=-Os ssl/$CLIENT >/dev/null
+    cd ..
+
+    ./ssl_server2 $SERVER_ARGS >/dev/null &
+    SRV_PID=$!
+    sleep 1;
+
+    if valgrind --tool=massif --stacks=yes programs/ssl/$CLIENT >/dev/null 2>&1
+    then
+        FAILED=0
+    else
+        echo "client failed" >&2
+        FAILED=1
+    fi
+
+    kill $SRV_PID
+    wait $SRV_PID
+
+    framework/scripts/massif_max.pl massif.out.*
+    mv massif.out.* massif-$NAME.$$
+}
+
+# preparation
+
+CONFIG_BAK=${CONFIG_H}.bak
+cp $CONFIG_H $CONFIG_BAK
+
+rm -f massif.out.*
+
+printf "building server... "
+
+make clean
+make lib >/dev/null 2>&1
+(cd programs && make ssl/ssl_server2) >/dev/null
+cp programs/ssl/ssl_server2 .
+
+echo "done"
+
+# actual measurements
+
+do_config   "ccm-psk-tls1_2" \
+            "" \
+            "psk=000102030405060708090A0B0C0D0E0F"
+
+do_config   "suite-b" \
+            "MBEDTLS_BASE64_C MBEDTLS_PEM_PARSE_C" \
+            ""
+
+# cleanup
+
+mv $CONFIG_BAK $CONFIG_H
+make clean
+rm ssl_server2
+
+exit $FAILED

vendor/mbedtls/scripts/min_requirements.py

@@ -0,0 +1,16 @@
+#!/usr/bin/env python3
+"""Install all the required Python packages, with the minimum Python version.
+"""
+
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+import os
+import framework_scripts_path # pylint: disable=unused-import
+from mbedtls_framework import min_requirements
+
+# The default file is located in the same folder as this script.
+DEFAULT_REQUIREMENTS_FILE = 'ci.requirements.txt'
+
+min_requirements.main(os.path.join(os.path.dirname(__file__),
+                                   DEFAULT_REQUIREMENTS_FILE))

vendor/mbedtls/scripts/prepare_release.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+# prepare_release.sh — Prepare the source tree for a release.
+#
+# This script switches the repo into “release” mode:
+#   - Updates all tracked `.gitignore` files to stop
+#     ignoring the automatically-generated files.
+#   - Sets the CMake option `GEN_FILES` to OFF to explicitely disable
+#     recreating the automatically-generated files.
+#.  - The script will recursively update the tf-psa-crypto files too.
+
+
+set -eu
+
+# Portable inline sed. Helper function that will automatically pre-pend
+# an empty string as the backup suffix (required by macOS sed).
+psed() {
+    # macOS sed does not offer a version
+    if sed --version >/dev/null 2>&1; then
+        sed -i "$@"
+    # macOS/BSD sed
+    else
+        sed -i '' "$@"
+    fi
+}
+
+#### .gitignore processing ####
+for GITIGNORE in $(git ls-files --recurse-submodules -- '*.gitignore'); do
+        psed '/###START_GENERATED_FILES###/,/###END_GENERATED_FILES###/s/^/#/' "$GITIGNORE"
+        psed 's/###START_GENERATED_FILES###/###START_COMMENTED_GENERATED_FILES###/' "$GITIGNORE"
+        psed 's/###END_GENERATED_FILES###/###END_COMMENTED_GENERATED_FILES###/' "$GITIGNORE"
+done
+
+#### Build scripts ####
+psed 's/^\(GEN_FILES[ ?:]*=\)\([^#]*\)/\1/' Makefile */Makefile
+psed '/[Oo][Ff][Ff] in development/! s/^\( *option *( *GEN_FILES  *"[^"]*"  *\)\([A-Za-z0-9][A-Za-z0-9]*\)/\1OFF/' CMakeLists.txt
+

vendor/mbedtls/scripts/project_name.txt

@@ -0,0 +1 @@
+Mbed TLS

vendor/mbedtls/scripts/tmp_ignore_makefiles.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# Temporarily (de)ignore Makefiles generated by CMake to allow easier
+# git development
+#
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+IGNORE=""
+
+# Parse arguments
+#
+until [ -z "$1" ]
+do
+  case "$1" in
+    -u|--undo)
+      IGNORE="0"
+      ;;
+    -v|--verbose)
+      # Be verbose
+      VERBOSE="1"
+      ;;
+    -h|--help)
+      # print help
+      echo "Usage: $0"
+      echo -e "  -h|--help\t\tPrint this help."
+      echo -e "  -u|--undo\t\tRemove ignores and continue tracking."
+      echo -e "  -v|--verbose\t\tVerbose."
+      exit 1
+      ;;
+    *)
+      # print error
+      echo "Unknown argument: '$1'"
+      exit 1
+      ;;
+  esac
+  shift
+done
+
+if [ "X" = "X$IGNORE" ];
+then
+  [ $VERBOSE ] && echo "Ignoring Makefiles"
+  git update-index --assume-unchanged Makefile library/Makefile programs/Makefile tests/Makefile
+else
+  [ $VERBOSE ] && echo "Tracking Makefiles"
+  git update-index --no-assume-unchanged Makefile library/Makefile programs/Makefile tests/Makefile
+fi