u-boot.git/lib/mbedtls, branch v2025.04

mbedtls: remove incorrect attribute type checker

2025-04-06T16:02:57Z

S/MIME Capabilities (OID: 1.2.840.113549.1.9.15) attributes are expected to be algorithms but neither data nor MS Inderect Data, thus the checker for data type is incorrect. This patch fixes a capsule authentication failure with PKCS#7 message that contains S/MIME capabilities, which formed by the EDK2 GenerateCapsule tool. S/MIME Capabilities are not common attributes in an EFI capsule, thus this failure cannot be reproduced with the capsules generated via mkeficapsule. Fixes: 7de0d155cce7 ("mbedtls: add PKCS7 parser porting layer") Reported-by: Ilias Apalodimas Signed-off-by: Raymond Mao

mbedtls: refactor mbedtls build for XPL

2025-02-27T18:11:02Z

Refactor the entire kconfig page for mbedtls, adapt mbedtls makefile and default config file using 'XPL_', in order to have independent mbedtls kconfig options in U-Boot Proper, SPL, TPL and VPL. User can choose legacy or mbedtls libraries for them independently. Set mbedtls native hashing libraries as default when MBEDTLS_LIB, SPL_MBEDTLS_LIB, TPL_MBEDTLS_LIB or VPL_MBEDTLS_LIB is selected. If users prefer using U-Boot legacy hashing libraries, please select MBEDTLS_LIB_HASHING_ALT, SPL_MBEDTLS_LIB_HASHING_ALT, TPL_MBEDTLS_LIB_HASHING_ALT or VPL_MBEDTLS_LIB_HASHING_ALT for U-Boot Proper, SPL, TPL and VPL respectively. Moreover, rename a few kconfig options and update their descriptions to improve the consistency of terminology. Signed-off-by: Raymond Mao Acked-by: Ilias Apalodimas

mbedtls: access mbedtls private members in mscode and pkcs7 parser

2025-02-27T18:11:02Z

U-Boot requires to access x509_internal.h, mbedtls_sha256_context and mbedtls_sha1_context in the porting layer, and this requires to enable MBEDTLS_ALLOW_PRIVATE_ACCESS. Enable it to mscode and pkcs7_parser to fix a mbedtls internal building error when X509 is selected. Moreover, Move it to a separate file to avoid enabling it in multiple places. Signed-off-by: Raymond Mao Acked-by: Ilias Apalodimas

mbedtls: fix incorrect kconfig dependencies on mbedtls

2025-02-27T18:11:02Z

Fixed the building failures when WGET_HTTPS,NET_LWIP and MBEDTLS_LIB are selected due to a few incorrect kconfig dependencies. Signed-off-by: Raymond Mao Reviewed-by: Ilias Apalodimas

mbedtls/external: remove broken git submodule

2025-02-13T15:53:18Z

When we squash imported mbedtls, the git submodule "framework" was preserved in the commit. However, U-Boot itself does not use git submodule, and provides no .gitmodules file to specify the submodule repository. This is normally not an issue when cloning U-Boot repository. However, when U-Boot is imported as a submodule, this will break git option `--recurse-submodules` as it fails to resolve "framework". As we do not use the submodule, remove it to unbreak existing workflows. Fixes: 12f1212e95fe ("Merge commit '0344c602eadc0802776b65ff90f0a02c856cf53c' as 'lib/mbedtls/external/mbedtls'") Signed-off-by: ZHANG Yuntian

mbedtls: Add SHA symbols for VPL

2025-02-03T22:00:42Z

Add some symbols for supporting SHA1 etc. for VPL. Signed-off-by: Simon Glass

lib: mbedtls: sha256: add support of key derivation

2025-01-18T23:12:47Z

Adds the support of key derivation using the scheme hkdf. This scheme is defined in rfc5869. Signed-off-by: Philippe Reynes Reviewed-by: Raymond Mao

lib: sha256: add feature sha256_hmac

2025-01-18T23:12:47Z

Adds the support of the hmac based on sha256. This implementation is based on rfc2104. Signed-off-by: Philippe Reynes Reviewed-by: Raymond Mao

lib: sha256: move common function to sha256_common.c

2025-01-18T23:12:47Z

The function sha256_csum_wd is defined in lib/sha256.c and in lib/mbedtls/sha256.c. To avoid duplicating this function (and future function), we move this function to the file lib/sha256_common.c Reviewed-by: Raymond Mao Signed-off-by: Philippe Reynes

mbedtls: enable support of hkdf

2025-01-18T23:12:47Z

Adds the support of key derivation using the scheme hkdf. Reviewed-by: Raymond Mao Signed-off-by: Philippe Reynes