WIP: Upgrade Mbed TLS to 3.6.7

[wuisabel-gif]

Summary of changes

Related to #557.

This draft updates the Mbed TLS sources included in Mbed OS to Mbed TLS 3.6.7.

The large number of changed files is expected because Mbed TLS is vendored into this repository. The update also includes the necessary compatibility and importer changes for Mbed OS.

The importer now normalizes generated file endings so that importing the same Mbed TLS release again produces no unexpected differences.

This is still a work in progress because additional build and hardware-test coverage is needed.

Impact of changes

Applications using Mbed TLS will use the newer 3.6.7 release.

No intentional changes are being made to the public Mbed OS API, but compatibility and behavior still need further testing before this PR is ready for review.

Migration actions required

None expected.

Documentation

None currently required.

---

Pull request type

[x] Patch update (Bug fix / Target update / Docs update / Test update / Refactor)
[ ] Feature update (New feature / Functionality change / New API)
[ ] Major update (Breaking change E.g. Return code change / API behaviour change)

---

Test results

[ ] No Tests required for this change (E.g docs only update)
[x] Covered by existing mbed-os tests (Greentea or Unittest)
[x] Tests / results supplied as part of this PR

Testing completed so far:

• Imported the official mbedtls-3.6.7 tag at upstream commit 068ff080b3.
• Repeated the import in a clean repository and confirmed that it produces no additional vendored-file changes.
• git diff --check passes.
• Importer shell syntax validation passes.
• General Greentea execution works on a NUCLEO-F401RE.
• The Mbed TLS self-test cannot run on the NUCLEO-F401RE because the target does not provide the required hardware TRNG support.
• The PSA sanity test is unsupported on this target.
• mbedtls-multi fails to synchronize on both this branch and unchanged upstream Mbed OS, so that failure does not appear to be caused by this upgrade.

Additional target builds, CI coverage, and Mbed TLS hardware testing are still needed. Suggestions for preferred targets or CI commands would be appreciated.

[wuisabel-gif]

CI found several compatibility issues that I still need to address. The first Greentea build failed because the self-test uses an old entropy header and MBEDTLS_SELF_TEST is disabled. The native unit tests also use a removed internal cipher header. In addition, two compatibility headers need license notices, and the documentation check does not understand some of the newer Mbed TLS documentation commands.

Most of the board builds shown as failed were actually cancelled after the first build failure. I’ll keep the PR as a draft while I work through these issues. I am looking for some advice on how to approach the Doxygen compatibility problem from the community.

[JohnK1987]

Two points to think about

1. because 3.6.x is close to the end of its life cycle, is it relevant to do this effort to almost obsolete 3.6.7?
2. for proper testing on real hardware you should use a devkit with ethernet port like Nucleo F429ZI or similar or newer. Only build is not enough for so huge change, I think.

[multiplemonomials]

Ah I'm actually the one that asked to port to 3.6.7 first. I figure it's a good "halfway point" between the version we were using and the latest supported version.

I do agree about the need to test on HW with Ethernet and TRNG support though. You can use the drivers list page to find target boards that do have those features. Taking a quick look through, seems like various Nucleo boards and the Nuvoton M460 would be your best options. If you end up getting a nucleo board, would be cool if ya could get this one: https://www.digikey.com/en/products/detail/stmicroelectronics/NUCLEO-H753ZI/21348937

as it's the new version of the obsoleted NUCLEO_H743ZI2 target board that we do support. I'd been wanting to test out Mbed OS on this for a while so that we can officially support the one that's actually in production.

[wuisabel-gif]

Thanks both. @JohnK1987 , that’s a fair concern. Since @multiplemonomials clarified that Mbed TLS 3.6.7 was requested as an intermediate step toward a newer supported release, so I’ll keep the scope focused on this incremental upgrade.

I also agree that build results alone are not enough for a change of this size. I’ll obtain a Nucleo board with Ethernet and hardware TRNG support, ideally the H753ZI, and test the upgrade against unchanged upstream Mbed OS.

At the same time, I will investigate the failed checks. The latest CI run has one actual failure on CY8CKIT_062S2_43012. It occurs in the Cypress hardware-crypto Mbed TLS adapter. I’ll keep the PR WIP while I investigate the Cypress compatibility issue.