libmbedtls: config: re-enable long long divisions

This reverts commit d3ec4328a070 ("libmbedtls: config: disable long long
divisions") to address performance regressions introduced by that
commit. T

libmbedtls: config: re-enable long long divisions

This reverts commit d3ec4328a070 ("libmbedtls: config: disable long long
divisions") to address performance regressions introduced by that
commit. The commit can be reverted now that __udivti3() needed by the
unsigned long long divisions is available again.

Link: https://github.com/OP-TEE/optee_os/pull/7359
Link: https://github.com/OP-TEE/optee_os/issues/7374
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

libmbedtls: config: disable long long divisions

Currently on Aarch64, mbedtls uses long long divisions which result in
calls to __udivti3() in libgcc. This is at the moment the only
dependency on li

libmbedtls: config: disable long long divisions

Currently on Aarch64, mbedtls uses long long divisions which result in
calls to __udivti3() in libgcc. This is at the moment the only
dependency on libgcc in mbedtls, so disable the long long divisions by
defining MBEDTLS_NO_UDBL_DIVISION to remove the dependency.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

libmbedtls: mbedtls_config_uta.h: enable SHA-384 and SHA-512 support

Enable SHA-384 and SHA-512 support for user TAs.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne

libmbedtls: mbedtls_config_uta.h: enable SHA-384 and SHA-512 support

Enable SHA-384 and SHA-512 support for user TAs.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

Squashed commit upgrading to mbedtls-3.6.0

Squash merging branch import/mbedtls-3.6.0

0fc9291f4 ("libmbedtls: bignum: restore mbedtls_mpi_exp_mod() from v3.5.2")
0ef87b1e6 ("libmbedtls: reset minim

Squashed commit upgrading to mbedtls-3.6.0

Squash merging branch import/mbedtls-3.6.0

0fc9291f4 ("libmbedtls: bignum: restore mbedtls_mpi_exp_mod() from v3.5.2")
0ef87b1e6 ("libmbedtls: reset minimum rsa key size")
70b079496 ("libmbedtls: adjust use of rsa pk_wrap API")
6cf76464f ("libmbedtls: allow inclusion of arm_neon.h")
27df5c911 ("libmbedtls: fix cipher_wrap.c for NIST AES Key Wrap mode")
aa584f9ed ("libmbedtls: fix cipher_wrap.c for chacha20 and chachapoly")
523ae957e ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify()")
30bdb1bbf ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pss_verify_ext()")
e45cdab62 ("libmbedtls: add SM2 curve")
d2fda4fc2 ("libmbedtls: fix no CRT issue")
ab0eb5515 ("libmbedtls: add interfaces in mbedtls for context memory operation")
7925a6f26 ("libmedtls: mpi_miller_rabin: increase count limit")
8eaf69279 ("libmbedtls: add mbedtls_mpi_init_mempool()")
12e83fc8d ("libmbedtls: make mbedtls_mpi_mont*() available")
f9e261da5 ("mbedtls: configure mbedtls to reach for config")
7b6f378d7 ("mbedtls: remove default include/mbedtls/config.h")
c16331743 ("Import mbedtls-3.6.0")

Signed-off-by: Tom Van Eyck <tom.vaneyck@kuleuven.be>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

libmbedtls: Enable nist_kw

Enable the AES KW mechanisms to be able to use them
from a trusted application.

Signed-off-by: Valerii Chubar <valerii_chubar@epam.com>
Signed-off-by: Sergiy Kibrik <Serg

libmbedtls: Enable nist_kw

Enable the AES KW mechanisms to be able to use them
from a trusted application.

Signed-off-by: Valerii Chubar <valerii_chubar@epam.com>
Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libmbedtls: mbedtls_config_uta.h: enable chacha20 and chachapoly support

Extend the mbedtls UTA configuration to support the ciphers chacha20 and
chachapoly for usage in custom TAs, as they are supp

libmbedtls: mbedtls_config_uta.h: enable chacha20 and chachapoly support

Extend the mbedtls UTA configuration to support the ciphers chacha20 and
chachapoly for usage in custom TAs, as they are supported by common
protocols, such as TLS1.3, IPsec or WireGuard

Signed-off-by: Simon Ott <simon.ott@aisec.fraunhofer.de>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

mbedtls: Add MBEDTLS_X509_CSR_WRITE_C define

Enable the mbedtls_x509write_csr_* functions that can be used
to create certificate signing requests by generating and
updating the structure mbedtls_x50

mbedtls: Add MBEDTLS_X509_CSR_WRITE_C define

Enable the mbedtls_x509write_csr_* functions that can be used
to create certificate signing requests by generating and
updating the structure mbedtls_x509write_csr.

Acked-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Florian Depraz <florian.depraz@alumni.epfl.ch>

show more ...

ta: switch to to mbedtls for bignum

Adds tee_api_arith_mpi.c wrapper providing the TEE Arithmetical API around
the big (mpi) routines from mbedtls.

CFG_TA_MBEDTLS_MPI=y (default y) enables the usag

ta: switch to to mbedtls for bignum

Adds tee_api_arith_mpi.c wrapper providing the TEE Arithmetical API around
the big (mpi) routines from mbedtls.

CFG_TA_MBEDTLS_MPI=y (default y) enables the usage of the bignum routines
in libutee.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mbedtls_config_uta.h: enable check key usage

Defines MBEDTLS_X509_CHECK_KEY_USAGE to enable checking key usage of a
certificate.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-o

mbedtls_config_uta.h: enable check key usage

Defines MBEDTLS_X509_CHECK_KEY_USAGE to enable checking key usage of a
certificate.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: configure and compile mbedtls

Configures mbedtls with a minimal user mode TA configuration and makes
it compile.

Adds dummy include/mbedtls_config_kernel.h to give a good error message

libmbedtls: configure and compile mbedtls

Configures mbedtls with a minimal user mode TA configuration and makes
it compile.

Adds dummy include/mbedtls_config_kernel.h to give a good error message
in case mbedTLS is compiled in for kernel mode.

mbedTLS is enabled for TAs with CFG_TA_MBEDTLS = y
Builtin self tests are enabled with CFG_TA_MBEDTLS_SELF_TEST = y

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...